[non-validated] DORA SFS E / SF 8: Contractual differentiation for critical ICT functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have written ICT service contracts established distinct contractual obligations for critical or important ICT functions compared to baseline requirements as specified in repository topic boundaries?
Explanation
[non-validated] Have ICT service contracts established stronger obligations for critical or important ICT functions compared to standard requirements as specified in repository topic boundaries?
Criterion and evidence
Assessed entity: Designated digital operational resilience service providers with critical functions under repository scope. Evidence period: 12-month review period. Verification requires documented contractual clauses explicitly distinguishing obligations for critical/important functions (e.g., service levels, audit rights, exit strategies) from baseline requirements, with implementation validation records per repository topic boundaries (E-repository-area#keyDescription).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of contractual differentiation?
Explicit contractual clauses specifying enhanced requirements for critical functions (e.g., 99.99% vs 99.5% uptime SLAs, quarterly vs annual audits), with implementation validation records. Generic 'compliance with DORA' statements without functional differentiation are insufficient per repository topic boundaries (E-repository-area#keyDescription).
Are alternatives permitted if critical function differentiation is impractical?
No. Repository topic boundaries (E-repository-area#keyDescription) mandate explicit distinction of additional requirements for critical functions from baseline obligations. No alternatives satisfy this requirement; unimplemented specifications remain pending evidence.
References
DORA: Provider contracts, subcontracting and exit