[non-validated] DORA SFS 1 / SF 2: ICT Risk Management Framework (Article 6)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented a documented ICT risk management framework harmonizing tools, methods, processes, and policies as required by DORA Article 6 (Regulation EU 2022/2554)?
Explanation
[non-validated] Has the designated financial entity implemented a documented ICT risk management framework harmonizing tools, methods, processes, and policies as required by DORA Article 6 (Regulation EU 2022/2554), including applicable simplifications for smaller entities under Article 16?
Criterion and evidence
Assess if the designated financial entity (per DORA Article 2) maintains a documented ICT risk framework meeting Article 6 requirements. Evidence period: current operational period up to assessment date. For entities qualifying under simplified regime (Article 16), verify documented framework contains minimum elements from EBA Regulatory Technical Standards. Valid evidence: approved framework demonstrating harmonized tools/methods/processes/policies with review/assurance functions; invalid: internal notes without structural reference to DORA requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for DORA Article 6 compliance?
A documented ICT risk management framework explicitly referencing DORA Article 6 implementation that demonstrates harmonized tools, methods, processes, and policies. For entities under simplified regime (Article 16), documented framework must contain minimum elements specified in EBA Regulatory Technical Standards. Internal audit follow-up and framework review mechanisms must be evidenced.
How are missing records treated under this criterion?
Missing documentation results in pending verification status; it does not automatically constitute failure. Required evidence must be submitted for definitive assessment per DORA evidence handling principles.
References
Regulation (EU) 2022/2554 (DORA)
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554 (opens in a new tab)
EBA RTS on ICT Risk Management Framework