[non-validated] DORA SFS E / SF 4: Documented subcontractor change management procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established documented procedures for managing subcontractor changes as required by DORA Articles 28 and 30 during the preceding 12 months?
Explanation
[non-validated] Has the designated digital operational resilience service provider established documented subcontractor change management procedures as required by DORA Articles 28 and 30 during the review period?
Criterion and evidence
Assess designated DORA-covered entities against documented subcontractor change procedures per Articles 28/30. Evidence period: preceding 12 months. Pass: validated written procedures with approval steps (e.g., 30-day notice, impact assessment) and transition validation evidence per Regulation (EU) 2022/2554. Fail: missing or incomplete documentation. Pending: unsubmitted evidence. Repository-prose reference only; no external verification performed.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for subcontractor change management compliance under DORA?
Documented procedures specifying mandatory approval steps (e.g., 30-day notice, impact assessment) and validated transition plans per DORA Articles 28/30. Evidence must demonstrate client approval and quarterly review validation. Unvalidated references or 'under development' status constitute pending evidence. Repository templates remain unverified draft content under repo-only constraints.
References
DORA: Provider contracts, subcontracting and exit