[non-validated] DORA SFS 1 / SF A: Staff learning and information-sharing procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented staff learning and information-sharing procedures for ICT risk management personnel within its ICT risk management framework as specified in the repository's topic description?
Explanation
[non-validated] Has the financial entity documented staff learning and information-sharing procedures for ICT risk management personnel within its ICT risk management framework as specified in DORA topic boundaries?
Criterion and evidence
Entity: Financial entities per DORA topic boundaries (standard/simplified regime applicability under Article 16). Condition: Documented staff learning and information-sharing procedures explicitly referenced within ICT risk management framework. Evidence period: Current operational period up to assessment date. Decision rule: Verification against repository-specified requirements; missing evidence remains pending (not automatic failure).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What demonstrates compliant documentation?
Documented procedures meeting repository topic boundaries (keyDescription passage) specifying content, frequency, personnel coverage, and linkage to ICT risk framework. Simplified regime entities must include minimum elements defined in repository guidelines.
References
DORA: ICT risk framework and assurance