Articles 28-30 put the obligation on you, not on your provider: assess before you sign, carry the mandatory clauses into the contract, and keep the evidence. This is that assessment, as an editable Excel.
DORA does not bind your ICT provider. It binds you: due diligence before the arrangement (Art. 28(4)), the mandatory contractual terms (Art. 30), concentration risk (Art. 29) and an exit strategy for critical or important functions (Art. 28(8)).
Service description, data locations, audit and access rights, sub-outsourcing, incident cooperation, continuity, resilience testing, exit. Each question cites the provision it comes from, so the assessment answers to a supervisor, not to a habit.
Record what the provider claims, what they actually sent, and what you concluded: Accepted, Follow-up or Gap. An empty evidence cell next to a Yes is the finding an inspection will make for you.
The Provider tab captures the identifiers, functions, countries and contract dates your register needs, at the moment you are already asking for them.
Instant access. Work email required.
One copy per provider, or per service where a provider supplies several.
The assessment is the start of the file, not the end of it.