Article 40, Ongoing Oversight, Digital Operational Resilience Act (DORA)
Overview
1. When conducting oversight activities, in particular general investigations or inspections, the Lead Overseer shall be assisted by a joint examination team established for each critical ICT third-party service provider.
2. The joint examination team referred to in paragraph 1 shall be composed of staff members from:
(a) the ESAs;
(b) the relevant competent authorities supervising the financial entities to which the critical ICT third-party service provider provides ICT services;
(c) the national competent authority referred to in Article 32(4), point (e), on a voluntary basis;
(d) one national competent authority from the Member State where the critical ICT third-party service provider is established, on a voluntary basis.
Members of the joint examination team shall have expertise in ICT matters and in operational risk. The joint examination team shall work under the coordination of a designated Lead Overseer staff member (the ‘Lead Overseer coordinator’).
3. Within 3 months of the completion of an investigation or inspection, the Lead Overseer, after consulting the Oversight Forum, shall adopt recommendations to be addressed to the critical ICT third-party service provider pursuant to the powers referred to in Article 35.
