[non-validated] DORA SFS E / SF 9: Contractual Rights and Obligations
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have written ICT service contracts established documented clauses explicitly defining contractual rights and obligations between parties as required by repository topic boundaries?
Explanation
[non-validated] Do documented ICT service contracts for entities under repository topic scope E include explicit clauses defining mutual contractual rights and obligations (e.g., performance standards, compliance verification protocols) with evidence of implementation during the preceding 12-month review period?
Criterion and evidence
Applies to entities designated under repository topic scope E. Requires contractual clauses explicitly defining mutual rights/obligations with verified implementation evidence during the 12-month review period. Evidence must demonstrate active application through implementation logs; generic references to 'contractual terms' without explicit definitions or unimplemented provisions do not satisfy the requirement. Missing documentation remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of contractual rights/obligations?
Valid evidence requires written contract sections explicitly defining mutual rights/obligations (e.g., 'Parties' responsibilities include quarterly performance reviews and compliance verification protocols') with implementation logs from the review period. Generic references to 'standard contractual terms' are insufficient.
How are missing evidence cases handled?
Pending status applies when contractual documentation is referenced but unprovided (e.g., 'Appendix A containing rights/obligations definitions under development'). Complete submission during the 12-month window is required for verification.
References
DORA: Provider contracts, subcontracting and exit