[non-validated] DORA SFS 1 / SF 0: ICT Risk Framework and Assurance
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated financial entity implemented a documented and approved ICT risk management framework covering risk tolerance, strategy, independent assurance functions, audit follow-up, and framework reviews as required by DORA Article 6 (Regulation EU 2022/2554), considering simplified regime applicability under Article 16?
Explanation
[non-validated] Does the designated financial entity maintain a documented and approved ICT risk management framework that includes risk tolerance definitions, resilience strategy components, independent assurance functions, audit follow-up procedures, and periodic framework reviews as required by DORA Article 6, with simplified regime adjustments applicable under Article 16 for qualifying entities?
Criterion and evidence
Applies to designated financial entities per DORA Article 2 within repository scope boundaries. Evidence period: current operational cycle up to assessment date. Verification requires documented framework demonstrating all six specified elements (framework, risk tolerance, strategy, independent assurance, audit follow-up, framework reviews). Simplified regime applicability per Article 16 determined by entity size/risk profile per repository guidelines. Unverified draft; no legal validation performed.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
How is entity applicability determined for this requirement?
Standard regime applies to all designated financial entities per DORA Article 2; simplified regime applicability (Article 16) is scoped by entity size/risk profile per repository boundaries. SFS 0 defines applicability parameters.
What constitutes valid evidence under the simplified regime?
For qualifying entities, documented framework containing minimum elements specified in repository description per Article 16 requirements. Full framework documentation required for standard regime entities.
How are missing evidence scenarios handled?
Absence of documented framework or incomplete element coverage results in pending verification; never treated as automatic non-compliance. Evidence must explicitly reference DORA Article 6 requirements.
References
Repository DORA: ICT Risk Framework Specification (v.0.0.1)