[non-validated] DORA SFS F / SF 4: Third-party ICT service provider oversight
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider established documented oversight mechanisms for third-party ICT service providers as required by DORA Articles 31-44?
Explanation
[non-validated] Has the designated critical ICT provider established documented oversight mechanisms for third-party ICT service providers as required by DORA Articles 31-44?
Criterion and evidence
Verify entity's formal designation as critical ICT provider under DORA Article 14, evidence of risk assessments covering critical third-party providers dated within current validity period, and contractual provisions for audit rights/remediation per Articles 31-44. No valid alternatives satisfy statutory requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for third-party oversight?
Documented risk assessments covering critical third-party providers and contracts containing audit rights/remediation clauses, dated within the current evidence period.
Are alternatives accepted when documentation is unavailable?
No valid alternatives; DORA Articles 31-44 require mandatory third-party oversight documentation with no permissible substitutes.
References
DORA: Critical provider oversight and supervisory readiness