[non-validated] DORA SFS E / SF C: Subcontractor Incident Assistance Obligations
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established documented incident assistance obligations for subcontractors including notification protocols and coordinated response support as required by DORA Articles 28 and 30?
Explanation
[non-validated] Has the entity implemented contractual obligations requiring subcontractors to provide incident notification, escalation procedures, and coordinated technical response support as mandated by DORA Articles 28 and 30?
Criterion and evidence
Applies to Digital Operational Resilience Service Providers under Regulation (EU) 2022/2554. Verification period: preceding 12 months. Requires documented subcontractor clauses with defined incident timelines, API integration protocols, and evidence of coordinated drills. Generic cooperation statements are insufficient; technical implementation details must be validated through audit or test logs.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for incident assistance obligations?
Valid evidence requires written contracts specifying subcontractor responsibilities (notification within 15 minutes, coordination mechanisms) and documented validation through quarterly joint response drills or audit reports. Generic 'cooperation' clauses without technical protocols are invalid. Missing documentation remains pending.
References
DORA: Provider contracts, subcontracting and exit