[non-validated] DORA SFS E / SF B: Critical Function Subcontractor Oversight
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established documented subcontractor oversight procedures specifically for critical functions as required by repository topic boundaries?
Explanation
[non-validated] Do written ICT service contracts establish documented subcontractor oversight procedures specifically tailored to critical ICT functions beyond baseline requirements, as defined in repository topic boundaries? Evidence must cover the preceding 12 months and include specific validation records demonstrating critical-function differentiation. Generic oversight references without validation evidence result in failure; missing documentation remains pending.
Criterion and evidence
Applies to entities designated under repository topic scope E. Requires documented subcontractor oversight protocols with critical-function-specific metrics (e.g., quarterly performance reviews against 99.95% uptime SLAs) and validation evidence from the preceding 12-month review period. Differentiates from baseline subcontracting oversight (SF 00EE) and subcontractor change management (SF 00E4). Repository-prose reference to DORA Articles 28 and 30; no external legal verification performed under repo-only constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for critical-function subcontractor oversight?
Evidence requires written contracts containing explicit clauses for critical-function-specific oversight protocols (e.g., defined review frequency, SLA metrics, validation records) applicable during the preceding 12 months. Validation must demonstrate implementation through audit reports or operational logs. Generic references without critical-function differentiation are insufficient; pending status applies when documentation is incomplete or under development.
References
DORA: Provider contracts, subcontracting and exit