[non-validated] DORA: Provider contracts, subcontracting and exit / SF 3
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established documented audit and inspection rights as required by DORA Articles 28 and 30?
Explanation
[non-validated] Verifies documented contractual provisions granting explicit audit and inspection rights as mandated by DORA Articles 28 and 30, ensuring verifiable access to systems, logs, and configurations for operational resilience assessment.
Criterion and evidence
Assess presence of contract clauses specifying audit scope (systems/logs/configurations), frequency, access mechanisms, and examination procedures per DORA Art. 28 & 30. Exclude generic compliance references without technical implementation details. Distinguish critical-function audit requirements from baseline contract controls (SF 00E0).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies documented audit and inspection rights requirements?
Sufficient evidence requires specific contractual clauses detailing access scope (systems, logs, configurations), examination frequency, and verification procedures. Generic references to compliance without explicit technical parameters do not satisfy this requirement.
References
DORA: Provider contracts, subcontracting and exit