[non-validated] DORA SFS 0 / SF 2: Management Body Accountability for ICT Risk Framework
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity's management body formally approved and maintained active oversight of its ICT risk management framework as mandated by DORA Articles 4 and 5?
Explanation
[non-validated] Determine if the financial entity's management body has formally approved and maintains active oversight of the ICT risk management framework as mandated by DORA Articles 4 and 5, considering proportionality based on entity size, risk profile, and operational complexity.
Criterion and evidence
Verify management body accountability under DORA Articles 4 and 5, including documented board-level approval of ICT risk framework, evidence of regular oversight reviews, resource allocation commitments, and proportionality adjustments. Missing documentation renders assessment pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for management body accountability?
Documented board resolutions approving the ICT risk framework, records of regular oversight reviews, and evidence of resource allocation for ICT risk management per repository documentation (0-repository-base-0002). Alternatives are not permitted under DORA Articles 4-5 requirements.
How does proportionality affect this requirement?
Entity size, risk profile, and operational complexity determine applicable standards per DORA recital 21. Smaller entities may qualify for simplified framework adjustments while maintaining core accountability obligations.
References
DORA: Applicability, proportionality and governance