[non-validated] DORA SFS E / SF 7: Prior Approval for Critical Function Subcontracting
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established documented prior approval procedures for subcontracting critical functions as required by repository topic boundaries?
Explanation
[non-validated] Do ICT service contracts include documented prior approval procedures for subcontracting critical functions as defined by repository topic boundaries?
Criterion and evidence
Verify entity role (designated providers for critical functions per repository topic scope), contractual clauses requiring explicit prior approval per repository boundaries, documented approval workflows with validation evidence, differentiated obligations for critical versus non-critical functions, and compliance during the preceding 12-month review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence constitutes sufficient validation?
Written contracts with explicit prior approval clauses for critical functions per repository topic boundaries, documented approval workflows with authorization protocols, and quarterly validation logs showing approved critical function subcontractors. Generic subcontracting clauses without critical function differentiation are insufficient.
How are missing implementation records handled?
Absence of documented approval procedures or validation evidence results in a negative outcome. Pending submission of contractual documentation and implementation records maintains 'pending' status.
Are there valid alternatives to the prior approval requirement?
No alternatives satisfy this mandatory repository requirement. The absence of valid alternatives is explicitly stated in questionContract under 'alternatives', maintaining regulatory boundaries per repository allocation.
References
DORA: Provider contracts, subcontracting and exit