[non-validated] DORA SFS 0 / SF C: Framework Designation Determination
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Does the financial entity correctly designate its applicable ICT risk management framework (standard or simplified) as mandated by DORA Article 5 based on its size, risk profile, and operational complexity?
Explanation
[non-validated] Does the financial entity correctly determine and document its applicable ICT risk management framework (standard or simplified) under DORA Article 5, based on its size, risk profile, and operational complexity?
Criterion and evidence
Verifies evidence of entity size metrics (staffing, turnover, balance sheet), risk profile alignment analysis, operational complexity assessment documentation, and formal framework designation decision per DORA Article 5(3). Considers Central Bank of Ireland proportionality guidance and EBA recital 13 requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence demonstrates correct framework designation?
Documented assessment of size metrics (e.g., staffing levels ≤45, turnover ≤€8M), risk profile analysis matching selected framework requirements, operational complexity evaluation, and formal approval records. Central Bank FAQ specifies proportionality documentation must address nature, scale and complexity of operations per Article 5(3).
Can alternatives satisfy this requirement?
No valid alternatives exist under DORA Article 5(3). Framework designation is strictly mandated based on entity characteristics with no substitutable approaches. Simplified framework eligibility requires explicit documentation meeting Central Bank guidance thresholds.
References
DORA: Applicability, proportionality and governance