The policy must keep contracts consistent with the ICT risk management framework, information security policy, ICT business continuity policy and incident reporting duties of DORA; require services supporting critical or important functions to be independently reviewed and included in the audit plan; and state that contracts do not relieve the entity or its management body of regulatory duties or responsibilities to clients, must not hinder supervision or breach supervisory restrictions, must require providers to cooperate with competent authorities, and must give the entity, its auditors and competent authorities effective access to data and premises.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.