[non-validated] DORA SFS 1 / SF E: Strategy Review Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented procedures for reviewing its digital operational resilience strategy as specified in the repository's DORA topic description?
Explanation
[non-validated] Has the financial entity documented procedures for reviewing its digital operational resilience strategy as required by the DORA repository topic specification?
Criterion and evidence
Assess documented strategy review procedures meeting repository-specified requirements for entities within DORA scope (considering simplified regime applicability). Evidence period: current operational cycle. Pass requires explicit documentation of review frequency, responsibilities, and update mechanisms referencing repository boundaries specifically for digital operational resilience strategy. Missing evidence remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this criterion?
Documented strategy review procedures explicitly referenced within the digital operational resilience strategy per repository keyDescription passage. Must demonstrate defined frequency, responsibilities, and update mechanisms specifically addressing strategy reviews (distinct from framework reviews). For simplified regime entities, procedures containing minimum elements specified in repository description.
How is missing evidence handled?
Remains pending verification through submission of required documentation; absence does not constitute automatic failure per repository guidelines. Evidence must explicitly reference digital operational resilience strategy review requirements.
References
DORA: ICT risk framework and assurance