DORA-Art35-P1 — DORA Knowledge Catalog

For the purpose of carrying out the duties laid down in this Section, the Lead Overseer shall have the powers to request all relevant information and documentation, to conduct general investigations and inspections, and to issue recommendations.

Evidence Profiles

Critical Provider Oversight Compliance Report RARE

Report documenting the oversight assessment of critical ICT third-party service providers, including their ICT risk management arrangements, security posture, and compliance with oversight requirements as required by DORA Articles 33-44.

Formats: PDF
Evidence Class: oversight-compliance-report
Availability: RARE
Update Frequency: annual
Typical Author: Lead Overseer / Internal Audit
Approval Chain: Head of Internal Audit → CRO

Content Sections

Expected Fields

Common Quality Issues

Oversight assessment based on provider self-reporting
No on-site assessment performed
Findings not tracked to remediation
Assessment scope limited to contractual obligations

Fact Schemas

oversight_compliance_status

Schema ID: fs-oversight-compliance-status
Control: DORA-Art33-P1

Valid Ranges

assessment_date: within last 12 months
overall_compliance_rating: compliant for continued service provision

Related Schemas

JSON Schema

{
  "properties": {
    "assessment_date": {
      "format": "date",
      "type": "string"
    },
    "critical_findings": {
      "minimum": 0,
      "type": "integer"
    },
    "findings_count": {
      "minimum": 0,
      "type": "integer"
    },
    "has_business_continuity": {
      "type": "boolean"
    },
    "has_incident_management": {
      "type": "boolean"
    },
    "has_risk_framework": {
      "type": "boolean"
    },
    "has_security_controls": {
      "type": "boolean"
    },
    "overall_compliance_rating": {
      "enum": [
        "compliant",
        "partially_compliant",
        "non_compliant"
      ],
      "type": "string"
    },
    "provider_id": {
      "minLength": 1,
      "type": "string"
    }
  },
  "required": [
    "provider_id",
    "assessment_date",
    "overall_compliance_rating",
    "has_risk_framework",
    "has_security_controls"
  ],
  "type": "object"
}