[non-validated] DORA SFS E / SF F: Non-critical ICT function contractual baselines
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have written ICT service contracts established documented baseline contractual rights and obligations for non-critical ICT functions as required by repository topic boundaries?
Explanation
[non-validated] Does the service provider maintain documented contractual clauses establishing baseline rights and obligations specifically for non-critical ICT functions as defined in repository topic boundaries?
Criterion and evidence
Entity role: designated digital operational resilience service providers for non-critical ICT functions per repository topic allocation (E-repository-area#keyDescription). Scope: Documentation of baseline contractual rights/obligations exclusively for non-critical functions. Evidence period: preceding 12 months. Decision rule: explicit contractual clauses differentiating non-critical requirements (e.g., service levels, audit rights) from critical function obligations per repository topic boundaries; generic terms fail verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Contractual documentation explicitly stating baseline obligations for non-critical ICT functions as differentiated in repository topic boundaries (E-repository-area#keyDescription), validated during the 12-month review period. Repository templates remain unverified draft content under repo-only constraints.
Why are critical function requirements excluded from this SF?
Per repository topic boundaries (E-repository-area#keyDescription), this SF exclusively covers non-critical function baselines. SF 00E8 handles critical function differentiation requirements per set organization.
References
DORA: Provider contracts, subcontracting and exit