Draft catalog: 16 sets and 256 questions. Browse the catalog →
UNIQ²MeHomeHomeMethodologyMethodologyCatalogCatalogMASKSMASKSAboutAboutContactContactRepositoryRepository
GitHub repository (opens in a new tab)
  • Catalog status
  • What is an SFS?
  • What is an SF?
  • Browse sets
    • SFS 0 — Applicability, proportionality and governance
      • [non-validated] DORA SFS 0 / SF 0: Simplified Framework Eligibility
      • [non-validated] DORA SFS 0 / SF 1 (placeholder)
      • [non-validated] DORA SFS 0 / SF 2: Management Body Accountability for ICT Risk Framework
      • [non-validated] DORA: Applicability, proportionality and governance | SF 3
      • [non-validated] DORA: Management Body Resource Allocation [SFS 0 / SF 4]
      • [non-validated] Group Structure Boundaries per Repository Guidelines
      • [non-validated] DORA: Critical ICT Third-Party Provider Designation
      • [non-validated] DORA SFS 0 / SF 7: Management Body Periodic Reviews (non-validated)
      • [non-validated] Management Body Framework Determination (DORA SFS 0/SF 8)
      • [non-validated] DORA: Repository-Defined Microenterprise Threshold Verification
      • [non-validated] DORA SFS 0 / SF A: Critical ICT Third-Party Risk Management Framework Compliance
      • [non-validated] DORA SFS 0 / SF B: Framework-Specific ICT Risk Management Implementation
      • [non-validated] DORA SFS 0 / SF C: Framework Designation Determination
      • [non-validated] DORA SFS 0 / SF D: Entity Scope Determination under Financial Sectors
      • [non-validated] DORA SFS 0 / SF E: Management Body's Joint Assessment for Framework Determination
      • [non-validated] DORA SFS 0 / SF F: Proportionality Verification
    • SFS 1 — ICT risk framework and assurance
      • [non-validated] DORA SFS 1 / SF 0: ICT Risk Framework and Assurance
      • [non-validated] SFS 1: ICT Risk Management Framework Elements (Repository Specification)
      • [non-validated] DORA SFS 1 / SF 2: ICT Risk Management Framework (Article 6)
      • [non-validated] DORA SFS 1 / SF 3: Independent Control/Assurance Functions Documentation
      • [non-validated] DORA SFS 1 / SF 4: ICT Risk Framework Audit Follow-up
      • [non-validated] DORA SFS 1 / SF 5: Documented ICT Risk Framework Review Procedures
      • [non-validated] DORA SFS 1 / SF 6: ICT Risk Tolerance Documentation
      • [non-validated] DORA SFS 1 / SF 7: ICT Risk Management Framework Strategy
      • [non-validated] DORA SFS 1 / SF 8: Board Approval of Digital Operational Resilience Strategy
      • [non-validated] DORA SFS 1 / SF 9: ICT Risk Framework Approval
      • [non-validated] DORA SFS 1 / SF A: Staff learning and information-sharing procedures
      • [non-validated] DORA SFS 1 / SF B: fields pending
      • [non-validated] DORA SFS 1 / SF C: ICT Systems Testing Policies
      • [non-validated] DORA: ICT Risk Management Framework and Assurance (SF D)
      • [non-validated] DORA SFS 1 / SF E: Strategy Review Documentation
      • [non-validated] DORA SFS 1 / SF F: ICT Risk Framework Coverage
    • SFS 2 — ICT assets, services and dependency mapping
      • [non-validated] DORA SFS 2 / SF 0: fields pending
      • [non-validated] DORA SFS 2 / SF 1: ICT Dependency Mapping for Critical Functions
      • [non-validated] DORA SFS 2: ICT Asset Ownership for Critical Business Functions
      • [non-validated] DORA SFS 2 / SF 3: ICT Third-Party Support End-Date Monitoring
      • [non-validated] DORA SFS 2 / SF 4: fields pending
      • [non-validated] DORA SFS 2: ICT Asset Management for Critical Functions (SF 5)
      • [non-validated] DORA SFS 2 / SF 6: ICT Asset Adequacy Assessments (Non-Validated Draft)
      • [non-validated] DORA SFS 2 / SF 7: Legacy ICT Systems Risk Assessment Documentation
      • [non-validated] DORA SFS 2: Legacy ICT Systems Risk Management for Critical Operations
      • [non-validated] DORA SFS 2 / SF 9: Business-function classification for critical/important functions
      • [non-validated] DORA SFS 2: ICT Asset Management Policy Implementation
      • [non-validated] DORA SFS 2 / SF B (placeholder)
      • [non-validated] DORA SFS 2 / SF C: ICT Asset Ownership Accountability for Critical Functions
      • [non-validated] DORA SFS 2 / SF D: ICT Third-Party Regulatory Register (Repository Allocation)
      • [non-validated] DORA SFS 2 / SF E: ICT Asset Inventory for Critical Functions
      • [non-validated] DORA SFS 2 / SF F: ICT Dependency Maps for Critical Functions
    • SFS 3 — Protection, access and data security
      • [non-validated] DORA SFS 3 / SF 0: Protection, access and data security
      • [non-validated] DORA SFS 3 / SF 1: fields pending
      • [non-validated] DORA SFS 3 / SF 2: Access Management Controls per Articles 9 and 15
      • [non-validated] DORA SFS 3 / SF 3
      • [non-validated] DORA SFS 3 / SF 4: Protection, access and data security
      • [non-validated] DORA SFS 3 / SF 5: Physical and Environmental Security Safeguards
      • [non-validated] DORA SFS 3 / SF 6: Network Segregation Measures
      • [non-validated] DORA SFS 3 / SF 7: Framework Selection Evidence
      • [non-validated] DORA SFS 3 / SF 8: Proportionate access, data and network safeguards
      • [non-validated] DORA SFS 3 / SF 9 (placeholder)
      • [non-validated] DORA SFS 3 / SF A: Proportionality Determination for Security Safeguards
      • [non-validated] DORA SFS 3 / SF B: Cryptographic Safeguards
      • [non-validated] DORA SFS 3 / SF C: Data Integrity & Availability Protocols (Unverified Draft)
      • [non-validated] DORA SFS 3 / SF D: Access Permission Reviews
      • [non-validated] Least Privilege Access Controls (DORA SFS 3E)
      • [non-validated] DORA SFS 3 / SF F: Security Framework Application
    • SFS 4 — Secure change, development and vulnerability management
      • [non-validated] DORA SFS 4 / SF 0 (placeholder)
      • [non-validated] DORA SFS 4 / SF 1 (placeholder)
      • [non-validated] DORA SFS 4 / SF 2 (placeholder)
      • [non-validated] DORA SFS 4 / SF 3: Secure Change, Development and Vulnerability Management (Repository Allocation)
      • [non-validated] DORA SFS 4 / SF 4: Emergency Change Procedures
      • [non-validated] DORA SFS 4 / SF 5: Vulnerability Treatment Procedures Compliance
      • [non-validated] DORA SFS 4 / SF 6: Patching Procedures Compliance
      • [non-validated] DORA SFS 4 / SF 7: Supported-System Lifecycle Management
      • [non-validated] DORA SFS 4 / SF 8 (ICT System Lifecycle Management)
      • [non-validated] DORA SFS 4 / SF 9: Authorization workflows for ICT change
      • [non-validated] DORA SFS 4 / SF A: Acquisition and Development Controls [REPO ALLOCATION]
      • [non-validated] DORA SFS 4 / SF B: Pre-deployment Security Testing Procedures
      • [non-validated] DORA SFS 4 / SF C: Implementation per Repository Topic Description
      • [non-validated] DORA SFS 4 / SF D: Emergency Change Procedures Requirement
      • [non-validated] DORA SFS 4 / SF E (placeholder)
      • [non-validated] DORA SFS 4 / SF F: ICT-Risk Technical Standards Implementation (No Generic Maturity Substitution)
    • SFS 5 — Monitoring and anomalous activity detection
      • [non-validated] DORA Topic 5 / SF 0: Monitoring and Anomalous Activity Detection
      • [non-validated] DORA SFS 5 / SF 1: Detection Thresholds Configuration
      • [non-validated] DORA SFS 5 / SF 2: Entity-Executed Detection Capability Testing
      • [non-validated] DORA SFS 5 / SF 3: Monitoring Responsibilities and Escalation Triggers (Article 10)
      • [non-validated] DORA SFS 5 / SF 4 (Monitoring and anomalous activity detection)
      • [non-validated] DORA SFS 5 / SF 5: Alert Generation for Detected Incidents
      • [non-validated] DORA SFS 5: Detection Threshold Periodic Review (SF 6)
      • [non-validated] DORA SFS 5 / SF 7: External Incident Reporting Procedures
      • [non-validated] DORA SFS 5 / SF 8: Comprehensive Monitoring Coverage
      • [non-validated] DORA SFS 5 / SF 9: Performance Degradation Detection Evidence
      • [non-validated] DORA SFS 5 / SF A: Monitoring Handoff to Classification Team
      • [non-validated] DORA SFS 5 / SF B: Repository-Defined Severity Thresholds for Incident Handoff
      • [non-validated] DORA SFS 5 / SF C: Continuous monitoring operations
      • [non-validated] DORA SFS 5 / SF D: Periodic Review of Escalation Triggers
      • [non-validated] DORA SFS 5 / SF E: Detection Capability Testing Validation
      • [non-validated] DORA SFS 5 / SF F: Detection capability testing across mandated incident types
    • SFS 6 — Incident management and classification
      • [non-validated] DORA SFS 6 / SF 0 (placeholder)
      • [non-validated] DORA SFS 6 / SF 1: Incident management and classification
      • [non-validated] DORA SFS 6 / SF 2 (Incident classification)
      • [non-validated] DORA SFS 6 / SF 3 (placeholder)
      • [non-validated] DORA SFS 6 / SF 4: Incident Classification Criteria
      • [non-validated] DORA SFS 6 / SF 5: fields pending
      • [non-validated] DORA SFS 6 / SF 6: Root Cause Analysis for Major ICT Incidents
      • [non-validated] DORA SFS 6 / SF 7: Impact Determination Procedures under Articles 17-18
      • [non-validated] DORA SFS 6 / SF 8: ICT Incident Handling Mechanisms
      • [non-validated] DORA SFS 6: ICT Incident Classification Procedures
      • [non-validated] DORA: Comprehensive ICT Incident Classification
      • [non-validated] DORA SFS 6 / SF B: fields pending
      • [non-validated] DORA SFS 6 / SF C
      • [non-validated] DORA SFS 6 / SF D: Incident ownership accountability (unverified draft)
      • [non-validated] DORA: Incident Management and Classification - SF E (Incident Detection & Recording)
      • [non-validated] DORA SF F: Incident Management Framework
    • SFS 7 — Incident reporting and communications
      • [non-validated] SFS 7 / SF 0: Incident notification using current templates
      • [non-validated] DORA: Incident reporting and communications - SFS 7 / SF 1
      • [non-validated] DORA SFS 7 / SF 2: Final Incident Reporting
      • [non-validated] DORA SFS 7 / SF 3: Voluntary notification of significant cyber threats
      • [non-validated] DORA SFS 7 / SF 4: Voluntary Cyber Threat Notification Procedures
      • [non-validated] DORA SFS 7 / SF 5: Maintained Accountability in Delegated Incident Reporting
      • [non-validated] DORA SFS 7 / SF 6: Client and Stakeholder Communication Procedures
      • [non-validated] DORA SFS 7 / Crisis Communication Protocols
      • [non-validated] DORA SFS 7 / SF 8: Competent Authority Determination for Incident Reporting
      • [non-validated] DORA SFS 7 / SF 9: Payment-Related Incident Reporting Scope
      • [non-validated] Documented Incident Classification Procedures (DORA SFS 7 / SF A)
      • [non-validated] DORA SFS 7 / SF B: Incident classification under repository topic allocation
      • [non-validated] DORA SFS 7 / SF C: Internal Incident Response Communication Protocols
      • [non-validated] DORA SFS 7 / SF D: Entity classification verification
      • [non-validated] DORA SFS 7 / SF E: Monitoring Incident Reporting Procedures
      • [non-validated] DORA SFS 7 / SF F: Verification of Current Incident Reporting Templates (Repository Draft)
    • SFS 8 — ICT business continuity and crisis response
      • [non-validated] DORA SFS 8 / SF 0: ICT Business Continuity and Crisis Response
      • [non-validated] DORA SFS 8 / SF 1: Activation Protocols for Crisis Management
      • [non-validated] DORA SFS 8 / SF 2: Continuity Policy for Critical ICT Functions
      • [non-validated] DORA SFS 8 / SF 3: Continuity Policy for Critical ICT Functions (Excluding Backup)
      • [non-validated] DORA SFS 8 / SF 4: Third-Party Dependency Continuity Arrangements
      • [non-validated] DORA SFS 8 / SF 5: Crisis Management Procedures for Critical ICT Functions
      • [non-validated] DORA SFS 8 / SF 6: Critical ICT Function Dependency Documentation
      • [non-validated] DORA SFS 8 / SF 7: Business Impact Analysis
      • [non-validated] DORA Article 11: Continuity Exercise Documentation for Critical ICT Functions
      • [non-validated] DORA SFS 8 / SF 9: Backup and Restoration Verification
      • [non-validated] DORA SFS 8 / SF A: ICT Continuity Policy Documentation
      • [non-validated] DORA SFS 8 / SF B (placeholder)
      • [non-validated] DORA SFS 8 / SF C: Continuity exercises for critical ICT functions
      • [non-validated] DORA SFS 8 / SF D: Internal Communication Coordination Protocols
      • [non-validated] DORA SFS 8 / SF E: Response and Recovery Plans
      • [non-validated] DORA SFS 8: ICT Business Continuity and Crisis Response (Activation Protocols) [repo-only]
    • SFS 9 — Backup, restoration and recovery
      • [non-validated] DORA SFS 9 / SF 0: Restoration Testing Verification
      • [non-validated] Repository DORA SFS 9 / SF 1: Backup Storage Segregation (Placeholder)
      • [non-validated] DORA: Backup, restoration and recovery - SFS 9 / SF 2: Documented Recovery Objectives
      • [non-validated] DORA SFS 9 / SF 3: Data reconciliation process verification
      • [non-validated] DORA SFS 9 / SF 4: Restoration Testing Documentation
      • [non-validated] DORA SFS 9 / SF 5: Redundant capacity during recovery
      • [non-validated] DORA SFS 9 / SF 6: Backup Storage Segregation
      • [non-validated] DORA SFS 9 / SF 7: Documented RTO and RPO Specifications
      • [non-validated] DORA SFS 9 / SF 8: Redundant Capacity for Backup Availability
      • [non-validated] DORA SFS 9 / SF 9: Data Reconciliation Process
      • [non-validated] DORA SFS 9 / SF A: Backup Scope Documentation
      • [non-validated] DORA SFS 9 / SF B: Backup protection technical controls
      • [non-validated] DORA SFS 9 / SF C: Recovery Priorities
      • [non-validated] DORA SFS 9 / SF D: Protect Backup Copies
      • [non-validated] DORA SFS 9 / SF E (unverified draft)
      • [non-validated] DORA SFS 9 / SF F: Backup Scope Verification
    • SFS A — Learning, staff readiness and information sharing
      • [non-validated] DORA SFS A / SF 0: Learning, staff readiness and information sharing
      • [non-validated] DORA SFS A / SF 1: Security awareness training implementation [draft]
      • [non-validated] DORA SFS A / SF 2: Threat Intelligence Sharing Arrangements
      • [non-validated] DORA SFS A / SF 3: Incident Notification Procedures
      • [non-validated] DORA SFS A / SF 4: Provider Participation Determination Documentation
      • [non-validated] DORA SFS A / SF 5: Management Security Awareness Training
      • [non-validated] DORA SFS A / SF 6: Incorporation of incident/test lessons into security awareness training
      • [non-validated] DORA SFS A / SF 7: Incident Notification Procedures with Timelines and Content Specifications
      • [non-validated] DORA SFS A / SF 8: Relevant Provider Participation
      • [non-validated] DORA: Incident/Test Lessons Analysis for Resilience Improvements
      • [non-validated] DORA SFS A / SF A: Threat Intelligence Sharing Determination
      • [non-validated] DORA SFS A / SF B: Provider Participation Determination
      • [non-validated] DORA Area A, SF C: Currency of Security Awareness Training Content
      • [non-validated] DORA Area A, SF D: Documented Incident Review Procedures for Lessons Learned
      • [non-validated] DORA SFS A / SF E: Documented selection criteria for information sharing provider selection
      • [non-validated] DORA SFS A / SF F: Evidence of Resilience Improvements from Implemented Measures
    • SFS B — Digital operational resilience testing programme
      • [non-validated] DORA SFS B / SF 0: Operational Resilience Testing Programme
      • [non-validated] DORA Article 24: Findings Register Closure Verification
      • [non-validated] DORA SFS B / SF 2: Operational Resilience Testing Scope Coverage
      • [non-validated] DORA SFS B / SF 3: Test Type Specifications for Critical Systems
      • [non-validated] DORA SFS B / SF 4: Operational Resilience Testing Program - Post-Remediation Validation
      • [non-validated] DORA SFS B / SF 5 - Organizational Separation in Test Teams
      • [non-validated] Repository-Allocated DORA SFS B / SF 6 (Verified Remediation Evidence)
      • [non-validated] DORA SFS B / SF 7: Repository-Aligned Findings Register Documentation Verification
      • [non-validated] DORA SFS B / SF 8: Documented Risk-Based Test Planning Methodology
      • [non-validated] DORA SFS B / SF 9: Documented Test Team Separation
      • [non-validated] DORA SFS B / SF A: Verified Remediation Evidence
      • [non-validated] DORA: Operational Resilience Testing Coverage (Article 24) - Repository Draft
      • [non-validated] DORA SFS B / SF C: Remediation Timeliness Documentation
      • [non-validated] DORA SFS B / SF D (placeholder)
      • [non-validated] DORA SFS B / SF E: Senior Management Communication (Repository Topic Documentation)
      • [non-validated] DORA SFS B / SF F: Operational resilience testing frequency (repository-defined)
    • SFS C — Threat-led penetration testing
      • [non-validated] DORA SFS C / SF 0 (placeholder)
      • [non-validated] DORA Compliance: Threat-led Penetration Testing (SFS C/SF 1)
      • [non-validated] DORA SFS C / SF 2: Threat-led penetration testing - tester independence
      • [non-validated] DORA SFS C / SF 3: Threat intelligence in threat-led penetration testing
      • [non-validated] DORA SFS C / SF 4: Tester Independence and Qualification
      • [non-validated] DORA SFS C / SF 5 (placeholder)
      • [non-validated] DORA SFS C / SF 6: Live-System Safeguards in Threat-Led Penetration Testing
      • [non-validated] DORA SFS C / SF 7 (repository-sourced template; no legal verification)
      • [non-validated] DORA SFS C / SF 8: Mutual Recognition of TLPT Results under Article 27
      • [non-validated] DORA Threat-led Penetration Testing: Vulnerability Remediation Documentation (SF C9)
      • [non-validated] DORA Threat-led Penetration Testing: Third-Party Participation Requirement (SF A)
      • [non-validated] DORA SFS C / SF B: Competent authority selection for threat-led penetration testing
      • [non-validated] DORA SFS C / SF C: Critical ICT Function Identification
      • [non-validated] DORA SFS C / SF D (Critical function scope coverage)
      • [non-validated] DORA SFS C / SF E: Critical functions coverage in threat-led penetration testing
      • [non-validated] DORA SFS C / SF F: TLPT Scope Documentation Requirement
    • SFS D — ICT third-party risk, concentration and register
      • [non-validated] DORA SFS D / SF 0: ICT Third-Party Risk Management
      • [non-validated] DORA SFS D / SF 1: ICT Third-Party Risk Register with Criticality Designations
      • [non-validated] DORA SFS D / SF 2: Concentration Risk Management
      • [non-validated] DORA SFS D / SF 3: Pre-contract assessment for critical ICT providers
      • [non-validated] DORA SFS D / SF 4: Accountable Ownership for ICT Third-Party Risk Management
      • [non-validated] DORA SFS D / SF 5: Conflicts of Interest Management
      • [non-validated] DORA SFS D / SF 6: Conflicts of interest management for ICT third-party arrangements
      • [non-validated] DORA SFS D / SF 7: ICT Third-Party Risk Register Submission
      • [non-validated] DORA SFS D / SF 8 (placeholder)
      • [non-validated] DORA SFS D / SF 9: Pre-contract ICT Third-Party Critical Service Assessment
      • [non-validated] DORA SFS D / SF A: Third-Party Strategy Accountability Oversight
      • [non-validated] DORA: Documentation of subcontracting arrangements in ICT third-party risk register (Article 28)
      • [non-validated] DORA SFS D / SF C: Group-level ICT Third-Party Risk Register
      • [non-validated] DORA: ICT Third-Party Due Diligence Register Documentation
      • [non-validated] DORA SFS D / SF E: Contractual Clauses for ICT Third-Party Subcontracting and Exits
      • [non-validated] DORA SFS D / SF F: Designated Critical ICT Third-Party Provider Oversight
    • SFS E — Provider contracts, subcontracting and exit
      • [non-validated] DORA SFS E / SF 0 (Provider contracts, subcontracting and exit)
      • [non-validated] DORA Area E: Provider Contracts, Subcontracting and Exit Strategies - Condition 1
      • [non-validated] DORA SFS E / SF 2: Incident assistance in ICT contracts
      • [non-validated] DORA: Provider contracts, subcontracting and exit / SF 3
      • [non-validated] DORA SFS E / SF 4: Documented subcontractor change management procedures
      • [non-validated] Termination Rights with Data Recovery for Critical Functions
      • [non-validated] DORA SFS E / SF 6: Data Storage Location Specifications
      • [non-validated] DORA SFS E / SF 7: Prior Approval for Critical Function Subcontracting
      • [non-validated] DORA SFS E / SF 8: Contractual differentiation for critical ICT functions
      • [non-validated] DORA SFS E / SF 9: Contractual Rights and Obligations
      • [non-validated] DORA SFS E / SF A: Contractual Enforceability for Critical Functions
      • [non-validated] DORA SFS E / SF B: Critical Function Subcontractor Oversight
      • [non-validated] DORA SFS E / SF C: Subcontractor Incident Assistance Obligations
      • [non-validated] DORA SFS E / SF D: Termination rights and exit strategies (baseline)
      • [non-validated] DORA SFS E / SF E: Subcontracting oversight in ICT contracts
      • [non-validated] DORA SFS E / SF F: Non-critical ICT function contractual baselines
    • SFS F — Critical provider oversight and supervisory readiness
      • [non-validated] DORA SFS F / SF 0: Critical Provider Inspection Access and Remediation Reporting
      • [non-validated] DORA: Critical provider oversight and supervisory readiness
      • [non-validated] DORA SFS F / SF 2: Critical provider oversight and supervisory readiness
      • [non-validated] DORA SFS F / SF 3: Repository placeholder (pending legal verification)
      • [non-validated] DORA SFS F / SF 4: Third-party ICT service provider oversight
      • [non-validated] DORA SFS F / SF 5: Supervisory Findings and Corrective Actions Documentation
      • [non-validated] DORA SFS F / SF 6: Operational resilience testing by designated critical ICT providers (Article 37)
      • [non-validated] DORA SFS F / SF 7: Critical Provider Oversight Requirements
      • [non-validated] DORA SFS F / SF 8: Supervisory Communication Records Maintenance (repository-sourced draft)
      • [non-validated] DORA SFS F / SF 9: Critical provider notification duty (Article 33)
      • [non-validated] DORA SFS F / SF A: Operational resilience testing for critical functions
      • [non-validated] DORA SFS F / SF B: Supervisory Liaison Officer Appointment
      • [non-validated] DORA: Critical provider oversight and supervisory readiness
      • [non-validated] Critical ICT Provider Incident Reporting Obligations Under DORA Article 37(1)-(2)
      • [non-validated] DORA SFS F / SF E: Incident severity categorization under Article 36
      • [non-validated] [field-updates-reviewed] DORA SFS F / SF F: completed refinements (unverified draft)
  • Requirement masks
    • Requirement masks
  • Live progress
  • Home
  • Methodology
    • Methodology overview
    • Introduction
    • Terms and notation
    • Evidence and interpretation
    • Question records
    • Assessment and validation
    • Assessment encoding
    • Requirement masks
    • Catalog versions
    • Worked examples
    • AI-assisted assessment
    • Frequently asked questions
    • Resources and related work
  • Catalog
    • Catalog status
    • What is an SFS?
    • What is an SF?
    • Browse sets
      • SFS 0 — Applicability, proportionality and governance
        • [non-validated] DORA SFS 0 / SF 0: Simplified Framework Eligibility
        • [non-validated] DORA SFS 0 / SF 1 (placeholder)
        • [non-validated] DORA SFS 0 / SF 2: Management Body Accountability for ICT Risk Framework
        • [non-validated] DORA: Applicability, proportionality and governance | SF 3
        • [non-validated] DORA: Management Body Resource Allocation [SFS 0 / SF 4]
        • [non-validated] Group Structure Boundaries per Repository Guidelines
        • [non-validated] DORA: Critical ICT Third-Party Provider Designation
        • [non-validated] DORA SFS 0 / SF 7: Management Body Periodic Reviews (non-validated)
        • [non-validated] Management Body Framework Determination (DORA SFS 0/SF 8)
        • [non-validated] DORA: Repository-Defined Microenterprise Threshold Verification
        • [non-validated] DORA SFS 0 / SF A: Critical ICT Third-Party Risk Management Framework Compliance
        • [non-validated] DORA SFS 0 / SF B: Framework-Specific ICT Risk Management Implementation
        • [non-validated] DORA SFS 0 / SF C: Framework Designation Determination
        • [non-validated] DORA SFS 0 / SF D: Entity Scope Determination under Financial Sectors
        • [non-validated] DORA SFS 0 / SF E: Management Body's Joint Assessment for Framework Determination
        • [non-validated] DORA SFS 0 / SF F: Proportionality Verification
      • SFS 1 — ICT risk framework and assurance
        • [non-validated] DORA SFS 1 / SF 0: ICT Risk Framework and Assurance
        • [non-validated] SFS 1: ICT Risk Management Framework Elements (Repository Specification)
        • [non-validated] DORA SFS 1 / SF 2: ICT Risk Management Framework (Article 6)
        • [non-validated] DORA SFS 1 / SF 3: Independent Control/Assurance Functions Documentation
        • [non-validated] DORA SFS 1 / SF 4: ICT Risk Framework Audit Follow-up
        • [non-validated] DORA SFS 1 / SF 5: Documented ICT Risk Framework Review Procedures
        • [non-validated] DORA SFS 1 / SF 6: ICT Risk Tolerance Documentation
        • [non-validated] DORA SFS 1 / SF 7: ICT Risk Management Framework Strategy
        • [non-validated] DORA SFS 1 / SF 8: Board Approval of Digital Operational Resilience Strategy
        • [non-validated] DORA SFS 1 / SF 9: ICT Risk Framework Approval
        • [non-validated] DORA SFS 1 / SF A: Staff learning and information-sharing procedures
        • [non-validated] DORA SFS 1 / SF B: fields pending
        • [non-validated] DORA SFS 1 / SF C: ICT Systems Testing Policies
        • [non-validated] DORA: ICT Risk Management Framework and Assurance (SF D)
        • [non-validated] DORA SFS 1 / SF E: Strategy Review Documentation
        • [non-validated] DORA SFS 1 / SF F: ICT Risk Framework Coverage
      • SFS 2 — ICT assets, services and dependency mapping
        • [non-validated] DORA SFS 2 / SF 0: fields pending
        • [non-validated] DORA SFS 2 / SF 1: ICT Dependency Mapping for Critical Functions
        • [non-validated] DORA SFS 2: ICT Asset Ownership for Critical Business Functions
        • [non-validated] DORA SFS 2 / SF 3: ICT Third-Party Support End-Date Monitoring
        • [non-validated] DORA SFS 2 / SF 4: fields pending
        • [non-validated] DORA SFS 2: ICT Asset Management for Critical Functions (SF 5)
        • [non-validated] DORA SFS 2 / SF 6: ICT Asset Adequacy Assessments (Non-Validated Draft)
        • [non-validated] DORA SFS 2 / SF 7: Legacy ICT Systems Risk Assessment Documentation
        • [non-validated] DORA SFS 2: Legacy ICT Systems Risk Management for Critical Operations
        • [non-validated] DORA SFS 2 / SF 9: Business-function classification for critical/important functions
        • [non-validated] DORA SFS 2: ICT Asset Management Policy Implementation
        • [non-validated] DORA SFS 2 / SF B (placeholder)
        • [non-validated] DORA SFS 2 / SF C: ICT Asset Ownership Accountability for Critical Functions
        • [non-validated] DORA SFS 2 / SF D: ICT Third-Party Regulatory Register (Repository Allocation)
        • [non-validated] DORA SFS 2 / SF E: ICT Asset Inventory for Critical Functions
        • [non-validated] DORA SFS 2 / SF F: ICT Dependency Maps for Critical Functions
      • SFS 3 — Protection, access and data security
        • [non-validated] DORA SFS 3 / SF 0: Protection, access and data security
        • [non-validated] DORA SFS 3 / SF 1: fields pending
        • [non-validated] DORA SFS 3 / SF 2: Access Management Controls per Articles 9 and 15
        • [non-validated] DORA SFS 3 / SF 3
        • [non-validated] DORA SFS 3 / SF 4: Protection, access and data security
        • [non-validated] DORA SFS 3 / SF 5: Physical and Environmental Security Safeguards
        • [non-validated] DORA SFS 3 / SF 6: Network Segregation Measures
        • [non-validated] DORA SFS 3 / SF 7: Framework Selection Evidence
        • [non-validated] DORA SFS 3 / SF 8: Proportionate access, data and network safeguards
        • [non-validated] DORA SFS 3 / SF 9 (placeholder)
        • [non-validated] DORA SFS 3 / SF A: Proportionality Determination for Security Safeguards
        • [non-validated] DORA SFS 3 / SF B: Cryptographic Safeguards
        • [non-validated] DORA SFS 3 / SF C: Data Integrity & Availability Protocols (Unverified Draft)
        • [non-validated] DORA SFS 3 / SF D: Access Permission Reviews
        • [non-validated] Least Privilege Access Controls (DORA SFS 3E)
        • [non-validated] DORA SFS 3 / SF F: Security Framework Application
      • SFS 4 — Secure change, development and vulnerability management
        • [non-validated] DORA SFS 4 / SF 0 (placeholder)
        • [non-validated] DORA SFS 4 / SF 1 (placeholder)
        • [non-validated] DORA SFS 4 / SF 2 (placeholder)
        • [non-validated] DORA SFS 4 / SF 3: Secure Change, Development and Vulnerability Management (Repository Allocation)
        • [non-validated] DORA SFS 4 / SF 4: Emergency Change Procedures
        • [non-validated] DORA SFS 4 / SF 5: Vulnerability Treatment Procedures Compliance
        • [non-validated] DORA SFS 4 / SF 6: Patching Procedures Compliance
        • [non-validated] DORA SFS 4 / SF 7: Supported-System Lifecycle Management
        • [non-validated] DORA SFS 4 / SF 8 (ICT System Lifecycle Management)
        • [non-validated] DORA SFS 4 / SF 9: Authorization workflows for ICT change
        • [non-validated] DORA SFS 4 / SF A: Acquisition and Development Controls [REPO ALLOCATION]
        • [non-validated] DORA SFS 4 / SF B: Pre-deployment Security Testing Procedures
        • [non-validated] DORA SFS 4 / SF C: Implementation per Repository Topic Description
        • [non-validated] DORA SFS 4 / SF D: Emergency Change Procedures Requirement
        • [non-validated] DORA SFS 4 / SF E (placeholder)
        • [non-validated] DORA SFS 4 / SF F: ICT-Risk Technical Standards Implementation (No Generic Maturity Substitution)
      • SFS 5 — Monitoring and anomalous activity detection
        • [non-validated] DORA Topic 5 / SF 0: Monitoring and Anomalous Activity Detection
        • [non-validated] DORA SFS 5 / SF 1: Detection Thresholds Configuration
        • [non-validated] DORA SFS 5 / SF 2: Entity-Executed Detection Capability Testing
        • [non-validated] DORA SFS 5 / SF 3: Monitoring Responsibilities and Escalation Triggers (Article 10)
        • [non-validated] DORA SFS 5 / SF 4 (Monitoring and anomalous activity detection)
        • [non-validated] DORA SFS 5 / SF 5: Alert Generation for Detected Incidents
        • [non-validated] DORA SFS 5: Detection Threshold Periodic Review (SF 6)
        • [non-validated] DORA SFS 5 / SF 7: External Incident Reporting Procedures
        • [non-validated] DORA SFS 5 / SF 8: Comprehensive Monitoring Coverage
        • [non-validated] DORA SFS 5 / SF 9: Performance Degradation Detection Evidence
        • [non-validated] DORA SFS 5 / SF A: Monitoring Handoff to Classification Team
        • [non-validated] DORA SFS 5 / SF B: Repository-Defined Severity Thresholds for Incident Handoff
        • [non-validated] DORA SFS 5 / SF C: Continuous monitoring operations
        • [non-validated] DORA SFS 5 / SF D: Periodic Review of Escalation Triggers
        • [non-validated] DORA SFS 5 / SF E: Detection Capability Testing Validation
        • [non-validated] DORA SFS 5 / SF F: Detection capability testing across mandated incident types
      • SFS 6 — Incident management and classification
        • [non-validated] DORA SFS 6 / SF 0 (placeholder)
        • [non-validated] DORA SFS 6 / SF 1: Incident management and classification
        • [non-validated] DORA SFS 6 / SF 2 (Incident classification)
        • [non-validated] DORA SFS 6 / SF 3 (placeholder)
        • [non-validated] DORA SFS 6 / SF 4: Incident Classification Criteria
        • [non-validated] DORA SFS 6 / SF 5: fields pending
        • [non-validated] DORA SFS 6 / SF 6: Root Cause Analysis for Major ICT Incidents
        • [non-validated] DORA SFS 6 / SF 7: Impact Determination Procedures under Articles 17-18
        • [non-validated] DORA SFS 6 / SF 8: ICT Incident Handling Mechanisms
        • [non-validated] DORA SFS 6: ICT Incident Classification Procedures
        • [non-validated] DORA: Comprehensive ICT Incident Classification
        • [non-validated] DORA SFS 6 / SF B: fields pending
        • [non-validated] DORA SFS 6 / SF C
        • [non-validated] DORA SFS 6 / SF D: Incident ownership accountability (unverified draft)
        • [non-validated] DORA: Incident Management and Classification - SF E (Incident Detection & Recording)
        • [non-validated] DORA SF F: Incident Management Framework
      • SFS 7 — Incident reporting and communications
        • [non-validated] SFS 7 / SF 0: Incident notification using current templates
        • [non-validated] DORA: Incident reporting and communications - SFS 7 / SF 1
        • [non-validated] DORA SFS 7 / SF 2: Final Incident Reporting
        • [non-validated] DORA SFS 7 / SF 3: Voluntary notification of significant cyber threats
        • [non-validated] DORA SFS 7 / SF 4: Voluntary Cyber Threat Notification Procedures
        • [non-validated] DORA SFS 7 / SF 5: Maintained Accountability in Delegated Incident Reporting
        • [non-validated] DORA SFS 7 / SF 6: Client and Stakeholder Communication Procedures
        • [non-validated] DORA SFS 7 / Crisis Communication Protocols
        • [non-validated] DORA SFS 7 / SF 8: Competent Authority Determination for Incident Reporting
        • [non-validated] DORA SFS 7 / SF 9: Payment-Related Incident Reporting Scope
        • [non-validated] Documented Incident Classification Procedures (DORA SFS 7 / SF A)
        • [non-validated] DORA SFS 7 / SF B: Incident classification under repository topic allocation
        • [non-validated] DORA SFS 7 / SF C: Internal Incident Response Communication Protocols
        • [non-validated] DORA SFS 7 / SF D: Entity classification verification
        • [non-validated] DORA SFS 7 / SF E: Monitoring Incident Reporting Procedures
        • [non-validated] DORA SFS 7 / SF F: Verification of Current Incident Reporting Templates (Repository Draft)
      • SFS 8 — ICT business continuity and crisis response
        • [non-validated] DORA SFS 8 / SF 0: ICT Business Continuity and Crisis Response
        • [non-validated] DORA SFS 8 / SF 1: Activation Protocols for Crisis Management
        • [non-validated] DORA SFS 8 / SF 2: Continuity Policy for Critical ICT Functions
        • [non-validated] DORA SFS 8 / SF 3: Continuity Policy for Critical ICT Functions (Excluding Backup)
        • [non-validated] DORA SFS 8 / SF 4: Third-Party Dependency Continuity Arrangements
        • [non-validated] DORA SFS 8 / SF 5: Crisis Management Procedures for Critical ICT Functions
        • [non-validated] DORA SFS 8 / SF 6: Critical ICT Function Dependency Documentation
        • [non-validated] DORA SFS 8 / SF 7: Business Impact Analysis
        • [non-validated] DORA Article 11: Continuity Exercise Documentation for Critical ICT Functions
        • [non-validated] DORA SFS 8 / SF 9: Backup and Restoration Verification
        • [non-validated] DORA SFS 8 / SF A: ICT Continuity Policy Documentation
        • [non-validated] DORA SFS 8 / SF B (placeholder)
        • [non-validated] DORA SFS 8 / SF C: Continuity exercises for critical ICT functions
        • [non-validated] DORA SFS 8 / SF D: Internal Communication Coordination Protocols
        • [non-validated] DORA SFS 8 / SF E: Response and Recovery Plans
        • [non-validated] DORA SFS 8: ICT Business Continuity and Crisis Response (Activation Protocols) [repo-only]
      • SFS 9 — Backup, restoration and recovery
        • [non-validated] DORA SFS 9 / SF 0: Restoration Testing Verification
        • [non-validated] Repository DORA SFS 9 / SF 1: Backup Storage Segregation (Placeholder)
        • [non-validated] DORA: Backup, restoration and recovery - SFS 9 / SF 2: Documented Recovery Objectives
        • [non-validated] DORA SFS 9 / SF 3: Data reconciliation process verification
        • [non-validated] DORA SFS 9 / SF 4: Restoration Testing Documentation
        • [non-validated] DORA SFS 9 / SF 5: Redundant capacity during recovery
        • [non-validated] DORA SFS 9 / SF 6: Backup Storage Segregation
        • [non-validated] DORA SFS 9 / SF 7: Documented RTO and RPO Specifications
        • [non-validated] DORA SFS 9 / SF 8: Redundant Capacity for Backup Availability
        • [non-validated] DORA SFS 9 / SF 9: Data Reconciliation Process
        • [non-validated] DORA SFS 9 / SF A: Backup Scope Documentation
        • [non-validated] DORA SFS 9 / SF B: Backup protection technical controls
        • [non-validated] DORA SFS 9 / SF C: Recovery Priorities
        • [non-validated] DORA SFS 9 / SF D: Protect Backup Copies
        • [non-validated] DORA SFS 9 / SF E (unverified draft)
        • [non-validated] DORA SFS 9 / SF F: Backup Scope Verification
      • SFS A — Learning, staff readiness and information sharing
        • [non-validated] DORA SFS A / SF 0: Learning, staff readiness and information sharing
        • [non-validated] DORA SFS A / SF 1: Security awareness training implementation [draft]
        • [non-validated] DORA SFS A / SF 2: Threat Intelligence Sharing Arrangements
        • [non-validated] DORA SFS A / SF 3: Incident Notification Procedures
        • [non-validated] DORA SFS A / SF 4: Provider Participation Determination Documentation
        • [non-validated] DORA SFS A / SF 5: Management Security Awareness Training
        • [non-validated] DORA SFS A / SF 6: Incorporation of incident/test lessons into security awareness training
        • [non-validated] DORA SFS A / SF 7: Incident Notification Procedures with Timelines and Content Specifications
        • [non-validated] DORA SFS A / SF 8: Relevant Provider Participation
        • [non-validated] DORA: Incident/Test Lessons Analysis for Resilience Improvements
        • [non-validated] DORA SFS A / SF A: Threat Intelligence Sharing Determination
        • [non-validated] DORA SFS A / SF B: Provider Participation Determination
        • [non-validated] DORA Area A, SF C: Currency of Security Awareness Training Content
        • [non-validated] DORA Area A, SF D: Documented Incident Review Procedures for Lessons Learned
        • [non-validated] DORA SFS A / SF E: Documented selection criteria for information sharing provider selection
        • [non-validated] DORA SFS A / SF F: Evidence of Resilience Improvements from Implemented Measures
      • SFS B — Digital operational resilience testing programme
        • [non-validated] DORA SFS B / SF 0: Operational Resilience Testing Programme
        • [non-validated] DORA Article 24: Findings Register Closure Verification
        • [non-validated] DORA SFS B / SF 2: Operational Resilience Testing Scope Coverage
        • [non-validated] DORA SFS B / SF 3: Test Type Specifications for Critical Systems
        • [non-validated] DORA SFS B / SF 4: Operational Resilience Testing Program - Post-Remediation Validation
        • [non-validated] DORA SFS B / SF 5 - Organizational Separation in Test Teams
        • [non-validated] Repository-Allocated DORA SFS B / SF 6 (Verified Remediation Evidence)
        • [non-validated] DORA SFS B / SF 7: Repository-Aligned Findings Register Documentation Verification
        • [non-validated] DORA SFS B / SF 8: Documented Risk-Based Test Planning Methodology
        • [non-validated] DORA SFS B / SF 9: Documented Test Team Separation
        • [non-validated] DORA SFS B / SF A: Verified Remediation Evidence
        • [non-validated] DORA: Operational Resilience Testing Coverage (Article 24) - Repository Draft
        • [non-validated] DORA SFS B / SF C: Remediation Timeliness Documentation
        • [non-validated] DORA SFS B / SF D (placeholder)
        • [non-validated] DORA SFS B / SF E: Senior Management Communication (Repository Topic Documentation)
        • [non-validated] DORA SFS B / SF F: Operational resilience testing frequency (repository-defined)
      • SFS C — Threat-led penetration testing
        • [non-validated] DORA SFS C / SF 0 (placeholder)
        • [non-validated] DORA Compliance: Threat-led Penetration Testing (SFS C/SF 1)
        • [non-validated] DORA SFS C / SF 2: Threat-led penetration testing - tester independence
        • [non-validated] DORA SFS C / SF 3: Threat intelligence in threat-led penetration testing
        • [non-validated] DORA SFS C / SF 4: Tester Independence and Qualification
        • [non-validated] DORA SFS C / SF 5 (placeholder)
        • [non-validated] DORA SFS C / SF 6: Live-System Safeguards in Threat-Led Penetration Testing
        • [non-validated] DORA SFS C / SF 7 (repository-sourced template; no legal verification)
        • [non-validated] DORA SFS C / SF 8: Mutual Recognition of TLPT Results under Article 27
        • [non-validated] DORA Threat-led Penetration Testing: Vulnerability Remediation Documentation (SF C9)
        • [non-validated] DORA Threat-led Penetration Testing: Third-Party Participation Requirement (SF A)
        • [non-validated] DORA SFS C / SF B: Competent authority selection for threat-led penetration testing
        • [non-validated] DORA SFS C / SF C: Critical ICT Function Identification
        • [non-validated] DORA SFS C / SF D (Critical function scope coverage)
        • [non-validated] DORA SFS C / SF E: Critical functions coverage in threat-led penetration testing
        • [non-validated] DORA SFS C / SF F: TLPT Scope Documentation Requirement
      • SFS D — ICT third-party risk, concentration and register
        • [non-validated] DORA SFS D / SF 0: ICT Third-Party Risk Management
        • [non-validated] DORA SFS D / SF 1: ICT Third-Party Risk Register with Criticality Designations
        • [non-validated] DORA SFS D / SF 2: Concentration Risk Management
        • [non-validated] DORA SFS D / SF 3: Pre-contract assessment for critical ICT providers
        • [non-validated] DORA SFS D / SF 4: Accountable Ownership for ICT Third-Party Risk Management
        • [non-validated] DORA SFS D / SF 5: Conflicts of Interest Management
        • [non-validated] DORA SFS D / SF 6: Conflicts of interest management for ICT third-party arrangements
        • [non-validated] DORA SFS D / SF 7: ICT Third-Party Risk Register Submission
        • [non-validated] DORA SFS D / SF 8 (placeholder)
        • [non-validated] DORA SFS D / SF 9: Pre-contract ICT Third-Party Critical Service Assessment
        • [non-validated] DORA SFS D / SF A: Third-Party Strategy Accountability Oversight
        • [non-validated] DORA: Documentation of subcontracting arrangements in ICT third-party risk register (Article 28)
        • [non-validated] DORA SFS D / SF C: Group-level ICT Third-Party Risk Register
        • [non-validated] DORA: ICT Third-Party Due Diligence Register Documentation
        • [non-validated] DORA SFS D / SF E: Contractual Clauses for ICT Third-Party Subcontracting and Exits
        • [non-validated] DORA SFS D / SF F: Designated Critical ICT Third-Party Provider Oversight
      • SFS E — Provider contracts, subcontracting and exit
        • [non-validated] DORA SFS E / SF 0 (Provider contracts, subcontracting and exit)
        • [non-validated] DORA Area E: Provider Contracts, Subcontracting and Exit Strategies - Condition 1
        • [non-validated] DORA SFS E / SF 2: Incident assistance in ICT contracts
        • [non-validated] DORA: Provider contracts, subcontracting and exit / SF 3
        • [non-validated] DORA SFS E / SF 4: Documented subcontractor change management procedures
        • [non-validated] Termination Rights with Data Recovery for Critical Functions
        • [non-validated] DORA SFS E / SF 6: Data Storage Location Specifications
        • [non-validated] DORA SFS E / SF 7: Prior Approval for Critical Function Subcontracting
        • [non-validated] DORA SFS E / SF 8: Contractual differentiation for critical ICT functions
        • [non-validated] DORA SFS E / SF 9: Contractual Rights and Obligations
        • [non-validated] DORA SFS E / SF A: Contractual Enforceability for Critical Functions
        • [non-validated] DORA SFS E / SF B: Critical Function Subcontractor Oversight
        • [non-validated] DORA SFS E / SF C: Subcontractor Incident Assistance Obligations
        • [non-validated] DORA SFS E / SF D: Termination rights and exit strategies (baseline)
        • [non-validated] DORA SFS E / SF E: Subcontracting oversight in ICT contracts
        • [non-validated] DORA SFS E / SF F: Non-critical ICT function contractual baselines
      • SFS F — Critical provider oversight and supervisory readiness
        • [non-validated] DORA SFS F / SF 0: Critical Provider Inspection Access and Remediation Reporting
        • [non-validated] DORA: Critical provider oversight and supervisory readiness
        • [non-validated] DORA SFS F / SF 2: Critical provider oversight and supervisory readiness
        • [non-validated] DORA SFS F / SF 3: Repository placeholder (pending legal verification)
        • [non-validated] DORA SFS F / SF 4: Third-party ICT service provider oversight
        • [non-validated] DORA SFS F / SF 5: Supervisory Findings and Corrective Actions Documentation
        • [non-validated] DORA SFS F / SF 6: Operational resilience testing by designated critical ICT providers (Article 37)
        • [non-validated] DORA SFS F / SF 7: Critical Provider Oversight Requirements
        • [non-validated] DORA SFS F / SF 8: Supervisory Communication Records Maintenance (repository-sourced draft)
        • [non-validated] DORA SFS F / SF 9: Critical provider notification duty (Article 33)
        • [non-validated] DORA SFS F / SF A: Operational resilience testing for critical functions
        • [non-validated] DORA SFS F / SF B: Supervisory Liaison Officer Appointment
        • [non-validated] DORA: Critical provider oversight and supervisory readiness
        • [non-validated] Critical ICT Provider Incident Reporting Obligations Under DORA Article 37(1)-(2)
        • [non-validated] DORA SFS F / SF E: Incident severity categorization under Article 36
        • [non-validated] [field-updates-reviewed] DORA SFS F / SF F: completed refinements (unverified draft)
    • Requirement masks
      • Requirement masks
    • Live progress
  • MASKS
    • MASKS overview
    • Complete catalog masks
    • Scoring Factor Set masks
    • Individual SF masks
  • About
  • Contact
  • Repository
Suggest a correction → (opens in a new tab)Edit this page on GitHub →
Catalog
Requirement masks
Requirement masks

Requirement masks

Catalog-bound masks require rebinding after catalog changes. No new mask generation was selected in this refinement. Read the catalog.

[non-validated] [field-updates-reviewed] DORA SFS F / SF F: completed refinements (unverified draft)Live progress

2026 © UNIQ2Me — Methodology and draft question catalog