[non-validated] DORA SFS 1 / SF C: ICT Systems Testing Policies
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented policies for testing ICT systems, controls, and processes as part of its ICT risk management framework per the repository's DORA topic description?
Explanation
[non-validated] Has the financial entity documented policies for testing ICT systems, controls, and processes within its approved ICT risk management framework per DORA Article 6 requirements, considering simplified regime applicability for qualifying entities?
Criterion and evidence
Verify entity-specific documentation of ICT testing policies covering scope, frequency, methodology, and outcome validation per admitted DORA source passages. Confirm simplified framework applicability for qualifying entities under EBA RTS.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence qualifies under the simplified regime?
For entities qualifying under simplified regime per EBA RTS, documented testing policies containing minimum elements specified in the Regulatory Technical Standards on simplified ICT risk management.
References
DORA: ICT risk framework and assurance