[non-validated] DORA SFS 1 / SF 8: Board Approval of Digital Operational Resilience Strategy
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity obtained documented board approval for its digital operational resilience strategy as specified in the repository's DORA topic description?
Explanation
[non-validated] Has the financial entity obtained formal board approval for its documented digital operational resilience strategy addressing ICT risks, as specified in the repository's DORA topic description and considering entity role applicability under standard or simplified regimes?
Criterion and evidence
Verify documented board approval of the digital operational resilience strategy per DORA Article 6 requirements. Applies to financial entities under standard/simplified regimes per repository guidelines. Evidence must include explicit board endorsement meeting repository-specified criteria; missing documentation remains pending. Simplified regime applies to qualifying smaller entities with minimum evidence requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for board approval?
Documented board resolution or approval record explicitly referencing repository topic boundaries and confirming endorsement of the resilience strategy. General business continuity notes without board-specific approval are insufficient.
Are there alternative requirements for smaller entities?
Entities qualifying under simplified regime per repository guidelines must provide documented board approval containing minimum elements specified. Full requirements apply to standard regime entities.
References
DORA: ICT risk framework and assurance