[non-validated] DORA: Critical provider oversight and supervisory readiness
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider cooperated with competent authorities in the assessment of its critical functions and continuity planning for ICT-related incidents as required by DORA Article 31?
Explanation
[non-validated] This requirement applies exclusively to designated critical ICT providers under DORA Regulation (EU) 2022/2554. It assesses documented cooperation with competent authorities during evaluations of critical functions and continuity planning for ICT incidents as mandated by Article 31. Evidence must be dated within the current DORA implementation period. Missing evidence remains pending; no alternatives satisfy this mandatory requirement.
Criterion and evidence
Entity scope: DORA-designated critical ICT providers only (distinct from financial entities/ordinary ICT providers). Condition: Active participation in authority-led critical function assessments per Article 31. Evidence period aligns with current DORA validity. Pass requires signed assessment reports showing completed evaluation; fail includes email confirmations without documentation. No alternatives accepted per Article 31 specification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence qualifies as sufficient proof of cooperation under Article 31?
Signed assessment reports from competent authorities dated within the evidence period, explicitly documenting completed critical function evaluation and continuity planning for ICT incidents. Records must show active provider participation; email acknowledgments without substantive documentation are insufficient.
References
DORA: Critical provider oversight and supervisory readiness