[non-validated] DORA SFS F / SF 2: Critical provider oversight and supervisory readiness
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider responded to supervisory requests from competent authorities as required by DORA Articles 31-44?
Explanation
[non-validated] Assess whether the designated critical ICT provider has fulfilled obligations to respond to supervisory requests from competent authorities under DORA Articles 31-44, distinguishing duties from those of financial entities and ordinary ICT providers. Evidence must show timely acknowledgment and documented actions taken per regulatory requirements.
Criterion and evidence
Verify entity's critical provider designation status and documented evidence of timely acknowledgment with completed actions in response to supervisory requests under DORA Articles 31-44, confirming distinction from financial-entity obligations and ordinary ICT provider duties. Evidence period aligns with current DORA implementation validity.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for supervisory request responses?
Official correspondence demonstrating timely acknowledgment and documented actions taken in response to supervisory requests from competent authorities as specified in DORA Articles 31-44. Absence of such documentation results in a pending assessment.
How does this condition apply across entity types?
Applies exclusively to designated critical ICT providers under Articles 31-44. Financial entities and ordinary ICT providers operate under different provisions; entity designation status must be verified before assessment.
References
DORA: Critical provider oversight and supervisory readiness