[non-validated] DORA SFS F / SF 0: Critical Provider Inspection Access and Remediation Reporting
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider granted inspection access and submitted remediation reports for oversight findings as required by DORA Articles 31-44?
Explanation
[non-validated] Does the entity, formally designated as a critical ICT provider under DORA Article 14, have documented evidence of granting inspection access and submitting remediation reports for oversight findings as required by Articles 31-44?
Criterion and evidence
Verify designated critical ICT provider status under DORA Article 14. Assess documentation of supervisory cooperation activities including inspection access logs and signed remediation reports dated within the current evidence period. Exclude financial entities and ordinary ICT providers. Required evidence: official correspondence confirming supervisory requests, dated access logs, and signed remediation reports.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
Which entities are subject to this requirement?
Only entities formally designated as critical ICT providers under DORA Article 14. Financial entities and ordinary ICT providers are outside scope; critical-provider designation must be verified through official records.
What constitutes sufficient evidence of supervisory cooperation?
Documented official correspondence confirming supervisory requests, dated logs demonstrating inspection access/cooperation, and signed remediation reports for findings—all within the current evidence period. Financial entities or ordinary ICT providers cannot satisfy this requirement.
References
DORA: Critical provider oversight and supervisory readiness