[non-validated] Management Body Framework Determination (DORA SFS 0/SF 8)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity's management body formally documented its determination of the applicable ICT risk management framework (standard or simplified) based on the entity's size, risk profile, and operational complexity as required by repository-specified governance principles?
Explanation
[non-validated] Does the financial entity's management body formally document its determination of the applicable ICT risk management framework (standard or simplified) based on the entity's size, risk profile, and operational complexity as required by DORA?
Criterion and evidence
Verify documented management body decision explicitly stating applicable framework (standard/simplified per DORA Articles 5(3) and 16), with evidence linking determination to entity size metrics, risk profile analysis, and operational complexity assessment. Evidence period: ongoing compliance assessment. Pass condition requires signed board resolution or equivalent formal documentation; missing evidence renders assessment pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of framework determination?
Formally documented management body decision explicitly stating applicable framework (standard/simplified), with supporting analysis of entity size metrics, risk profile, and operational complexity. Examples include board resolutions referencing DORA Article 5(3) with supporting documentation.
How are missing or contradictory records handled?
Assessment remains pending when documented framework determination is unavailable. Entity assertions without documented management body decisions do not satisfy the criterion. Conflicting evidence requires resolution through updated formal documentation.
References
DORA: Applicability, proportionality and governance