[non-validated] DORA SFS E / SF 6: Data Storage Location Specifications
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts documented permitted data storage/processing locations and access controls for subcontracted services as required by repository topic boundaries?
Explanation
[non-validated] Do ICT service contracts specify permitted data storage/processing locations for subcontracted services as defined in repository topic boundaries?
Criterion and evidence
Verify contractual clauses documenting permitted data storage/processing locations (e.g., specified jurisdictions) and cross-border transfer protocols per repository topic boundaries (E-repository-area#keyDescription), excluding unverified legal citations. Technical implementation evidence required for access controls during review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Written contracts with explicit clauses naming permitted jurisdictions (e.g., Germany/Greece data centers) and technical implementation evidence of access controls per repository topic boundaries. Generic references to 'data compliance' without technical specifications are insufficient, as shown in fixture-satisfied example.
References
DORA: Provider contracts, subcontracting and exit