[non-validated] Group Structure Boundaries per Repository Guidelines
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented its group structure boundaries to correctly determine its applicable ICT risk management framework under DORA requirements?
Explanation
[non-validated] Determine whether the financial entity has documented evidence of its group structure boundaries to establish the correct ICT risk management framework applicability under DORA requirements, considering repository-specified guidelines for corporate positioning.
Criterion and evidence
Verify documented group boundary analysis meeting repository-specified requirements for group structure considerations, including evidence of corporate relationship definitions and framework applicability determinations. Evidence period: ongoing; missing documentation renders assessment pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of documented group structure boundaries?
Documented evidence must explicitly define the entity's position within corporate structures per repository-specified guidelines, including ownership relationships and boundary impacts on framework selection. Organizational charts with ownership stakes or registration documents are acceptable.
How are missing boundary determinations handled?
Assessment remains pending when documentation is absent. Claims of 'no group structure' without repository-supported evidence constitute unverified assertions.
References
DORA: Applicability, proportionality and governance