[non-validated] DORA SFS 0 / SF 7: Management Body Periodic Reviews (non-validated)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity's management body documented periodic reviews confirming continued alignment of its ICT risk management framework with the applicable regime (standard or simplified) under DORA Articles 5 and 16, based on current size, risk profile, and operational complexity?
Explanation
[non-validated] Has the financial entity's management body documented periodic reviews confirming that its ICT risk management framework remains aligned with the applicable regime (standard or simplified) under DORA Articles 5 and 16, based on current size, risk profile, and operational complexity?
Criterion and evidence
Verify documented management body reviews assessing ICT risk framework applicability per DORA Articles 5/16 against current entity characteristics (size, risk profile, operational complexity). Actor: Financial entity management body. Evidence period: Ongoing compliance assessment. Required evidence: Records demonstrating periodic framework reassessment and alignment confirmation. Missing evidence = pending review records.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented records of periodic management body reviews explicitly confirming ICT risk framework alignment with current entity characteristics per DORA Articles 5/16. Must show review date, participants, framework designation decision, and supporting rationale.
Are there valid alternatives to documented periodic reviews?
No. Repository-specified requirements mandate documented periodic reviews without substitutable approaches. Absence of documented evidence constitutes non-compliance.
How is missing evidence handled?
Assessment remains pending until documented review records are submitted. Claims of verbal discussions or informal assessments do not satisfy the requirement.
References
DORA: Applicability, proportionality and governance