[non-validated] DORA SFS 1 / SF 7: ICT Risk Management Framework Strategy
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented and approved a digital operational resilience strategy addressing ICT risks as specified in the repository's DORA topic boundaries?
Explanation
[non-validated] Has a documented and approved digital operational resilience strategy addressing ICT risks been maintained, as specified in the repository's topic description?
Criterion and evidence
Verify documented resilience strategy meeting repository topic description requirements covering framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. Entity role applicability defined in SFS 0; simplified regime entities require minimum elements per repository description. Evidence period: current operational period. Missing evidence remains pending; absence does not constitute automatic non-compliance.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented resilience strategy explicitly covering framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews as per repository topic description. General business continuity notes without ICT-specific strategy elements are insufficient.
How are simplified regime entities treated?
Entities qualifying under the repository-described simplified regime require documented strategies containing only minimum elements specified in the topic description.
How is missing evidence evaluated?
Pending verification through strategy documentation records; absence of evidence does not automatically constitute non-compliance but remains unresolved until verified.
References
DORA: ICT risk framework and assurance