[non-validated] DORA SFS 1 / SF 9: ICT Risk Framework Approval
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented its digital operational resilience strategy as specified in the repository's DORA topic description regarding required components and entity applicability?
Explanation
[non-validated] Has the financial entity documented and obtained approval for its ICT risk management framework and digital operational resilience strategy, ensuring coverage of risk tolerance definitions, strategy components, independent assurance functions, audit follow-up procedures, and framework review cycles as specified in repository topic boundaries?
Criterion and evidence
Verify documented approval of ICT risk framework meeting repository-specified requirements under DORA Article 6, including all required components (risk tolerance, strategy, independent assurance functions, audit follow-up procedures, framework reviews). Confirm entity applicability under standard/simplified regime per supervision references.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies documented approval requirement?
Formal authorization records (e.g., board resolutions) explicitly referencing repository topic boundaries and DORA Article 6 elements. Internal email threads or draft documents without final approval do not qualify. Simplified regime entities must show minimum required elements per repository description.
How is missing evidence handled?
Pending verification through documented approval records meeting repository-specified requirements. Absence of evidence is not automatic failure but remains pending until proper documentation is provided.
References
DORA: ICT risk framework and assurance