[non-validated] DORA SFS 0 / SF E: Management Body's Joint Assessment for Framework Determination
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity's management body documented its joint assessment of size metrics, risk profile, and operational complexity to determine the applicable ICT risk management framework as specified by repository governance requirements?
Explanation
[non-validated] Determine whether the financial entity's management body has documented a joint assessment of its size metrics, risk profile, and operational complexity to select the applicable ICT risk management framework (standard or simplified) as mandated by DORA Articles 5 and 16.
Criterion and evidence
Verify documented evidence from the management body assessing entity size metrics, risk profile, and operational complexity to determine the applicable ICT risk management framework under DORA Articles 5 and 16. Evidence must collectively address all three factors; missing documentation renders the assessment pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this assessment?
Documented management body analysis evaluating entity size metrics, risk profile, and operational complexity together, with evidence demonstrating the framework designation decision was based on this combined assessment per repository guidelines.
Are there any acceptable alternatives to the required evidence?
No valid alternatives satisfy this criterion; repository-specified governance requirements mandate documented joint assessment of all three determination factors without substitutable approaches.
References
DORA: Applicability, proportionality and governance