[non-validated] DORA SFS 0 / SF F: Proportionality Verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Does the financial entity implement its ICT risk management framework proportionally, considering its size, risk profile, and operational complexity including group structure impacts where applicable per DORA requirements?
Explanation
[non-validated] Does the financial entity implement its ICT risk management framework proportionally, considering its size, risk profile, and operational complexity including group structure impacts where applicable per DORA requirements?
Criterion and evidence
Verify implementation of proportionality in ICT risk management framework using DORA recital 13 and Central Bank of Ireland guidance (passage p3), considering entity size metrics, risk profile, operational complexity, and group structure impacts where applicable.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for proportionality implementation?
Documented analysis showing how entity size metrics, risk profile, operational complexity, and group structure impacts (where applicable) were considered in designing ICT risk management controls per Central Bank of Ireland guidance (p3) and DORA recital 13.
How should group structure impacts be evaluated?
Evidence must demonstrate how subsidiary risk profiles and dependencies were assessed within group oversight framework, with control scaling matching subsidiary characteristics per Central Bank of Ireland guidance (p3).
Are there valid alternatives to this requirement?
No valid alternatives satisfy this criterion as proportionality implementation is explicitly mandated under DORA recital 13 and Central Bank of Ireland guidance with no substitutable approaches.
References
DORA: Applicability, proportionality and governance