[non-validated] DORA SFS E / SF 2: Incident assistance in ICT contracts
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established documented incident assistance provisions for critical functions as required by DORA Articles 28 and 30 during the preceding 12 months?
Explanation
[non-validated] Has the service provider established documented incident assistance provisions for critical functions in ICT service contracts as required by DORA Articles 28 and 30 during the preceding 12 months?
Criterion and evidence
Applies to designated digital operational resilience service providers under DORA. Requires documented contractual incident assistance obligations (root cause analysis, mitigation support, technical coordination) for critical systems during ICT incidents within the review period. Evidence period: preceding 12 months. DORA Articles 28 and 30 define mandatory incident assistance provisions for critical functions.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Evidence must show written contracts with explicit incident assistance clauses specifying root cause analysis, mitigation support, and technical coordination commitments for critical systems within 1 hour of incident declaration for critical systems. General 'incident management' references without specific obligations are insufficient.
Are there valid alternatives to satisfy this criterion?
No alternatives exist; prescribed incident assistance provisions in contractual terms are mandatory under DORA Articles 28 and 30 for designated service providers of critical functions, as defined in repository topic boundaries.
References
DORA: Provider contracts, subcontracting and exit