[non-validated] DORA SFS F / SF 8: Supervisory Communication Records Maintenance (repository-sourced draft)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider maintained complete records of supervisory communications and cooperation activities as required by DORA Articles 31-44?
Explanation
[non-validated] Assess whether the designated critical ICT provider (not financial entity or ordinary ICT provider) maintains records of supervisory communications and cooperation activities under DORA topic boundaries per pinned repository definitions.
Criterion and evidence
[non-validated] Actor: Designated critical ICT provider (excludes financial entities/ordinary ICT providers). Scope: DORA Articles 31-44 as defined in repository topic boundaries. Evidence period: Current period per repository-sourced implementation context. Positive: Logs showing supervisory request details with corresponding cooperation records (e.g., access logs, meeting minutes). Negative: Absence of required documentation. Missing evidence: Pending status. Alternatives: None as specified for this repository-sourced draft scope.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies the requirement under repository-sourced definitions?
Compliance requires documentation showing supervisory communications (e.g., authority requests with scope/deadlines) paired with cooperation evidence (access logs, meeting minutes, signed confirmations) as defined in repository topic boundaries. Email acknowledgments without cooperation records are insufficient per draft specifications. Missing evidence remains pending; repository text provides no verified legal alternatives.
References
DORA: Critical provider oversight and supervisory readiness