DORA, Artikkel 37, SE

1. The Lead Overseer may, by simple request or by decision, require critical ICT third-party service providers to provide all information that is necessary for the Lead Overseer to carry out its duties under this Regulation, including all relevant business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports, as well as any information relating to parties to whom the critical ICT third-party service provider has outsourced operational functions or activities.

2. When sending a simple request for information under paragraph 1, the Lead Overseer shall:

(a)

refer to this Article as the legal basis of the request;

(b)

state the purpose of the request;

(c)

specify what information is required;

(d)

set a time limit within which the information is to be provided;

(e)

inform the representative of the critical ICT third-party service provider from whom the information is requested that he or she is not obliged to provide the information, but in the event of a voluntary reply to the request the information provided must not be incorrect or misleading.

3. When requiring by decision to supply information under paragraph 1, the Lead Overseer shall:

(a)

Offisiell kilde

Versjon: 560220142d98b8ec

SHA-256: sha256:560220142d98b8ec8f8e269c368713824e06fe8a76f148882797161ce6c3c972

Geografiske artikkelagenter

Source: NovaCopilot