[non-validated] DORA SFS 0 / SF B: Framework-Specific ICT Risk Management Implementation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented ICT risk management controls matching its designated framework (standard or simplified) as specified by repository governance requirements based on its size, risk profile, and operational complexity?
Explanation
[non-validated] Assesses whether the financial entity implements ICT risk management controls matching its designated framework (standard or simplified) as mandated by repository governance requirements, based on its size, risk profile, and operational complexity under the proportionality principle.
Criterion and evidence
Verify documented classification of designated ICT risk management framework (standard/simplified per repository guidelines), implemented controls matching framework requirements, and periodic review records against evolving risk profile. Evidence must demonstrate alignment with entity size, risk profile, and operational complexity per repository-specified recitals.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
How is the applicable framework (standard vs simplified) determined?
Based on entity size, risk profile, and operational complexity per repository guidelines. Documentation must justify framework selection and periodic reassessment against evolving risk profile. Repository evidence shows simplified framework eligibility matching size/risk profile parameters.
What evidence validates proper framework implementation?
Documented controls matching the designated framework's requirements, including resource allocation and oversight procedures. Incomplete implementation or mismatched controls (e.g., systemically important entity applying simplified framework without justification) constitutes failure. Missing documentation leaves assessment pending.
References
DORA: Applicability, proportionality and governance