[non-validated] DORA SFS F / SF 7: Critical Provider Oversight Requirements
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider conducted regular business continuity testing for essential and important functions as required by DORA Article 42?
Explanation
[non-validated] Has the designated critical ICT provider implemented the oversight and supervisory cooperation measures required under applicable DORA provisions for critical provider supervision?
Criterion and evidence
Verifies oversight implementation for designated critical ICT providers under DORA article ranges 31-44 and 46-56. Evidence: documentation of supervisory request cooperation, inspection access arrangements, and remediation of oversight findings. Excludes financial entities and ordinary ICT providers.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence demonstrates compliance with critical provider oversight requirements?
Documentation showing cooperation with supervisory requests, evidence of providing access for inspections, and records of implementing remediation following oversight findings as specified in DORA article ranges 31-44 and 46-56.
How are non-critical entities treated in this assessment?
Financial entities and ordinary ICT providers fall outside this specific oversight requirement. The assessment applies exclusively to formally designated critical ICT providers under DORA.
References
DORA: Critical provider oversight and supervisory readiness