[non-validated] DORA SFS 1 / SF 6: ICT Risk Tolerance Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented ICT risk tolerance levels as specified in the ICT risk management framework per the repository's DORA topic description?
Explanation
[non-validated] Has the financial entity documented ICT risk tolerance levels within its approved risk management framework, as required by DORA Article 6 per the repository's topic boundaries? Evidence must explicitly reference the framework; absence leads to pending verification, not automatic failure.
Criterion and evidence
Verify documented ICT risk tolerance levels per DORA Article 6 within approved framework. Assess applicability based on entity role (critical/ordinary financial entity), considering simplified regime eligibility per repository guidance. Evidence must include defined thresholds per repository keyDescription; missing documentation remains pending per repository topic boundaries.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for documented risk tolerance levels?
Evidence requires explicit reference to documented risk tolerance levels within approved framework per repository keyDescription, showing defined thresholds. General risk management statements without specific tolerance levels are insufficient. Simplified regime entities must document minimum elements specified in repository description. Absence of documentation remains pending verification.
References
DORA: ICT risk framework and assurance