[non-validated] DORA SFS 1 / SF F: ICT Risk Framework Coverage
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented that its ICT risk management framework covers all required elements specified in the repository description: framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up, and framework reviews?
Explanation
[non-validated] Has the financial entity documented that its ICT risk management framework covers all required elements specified in the repository description: framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up, and framework reviews?
Criterion and evidence
Applies to financial entities under DORA scope per repository topic boundaries. Evidence period: current operational period. Decision rule: Documented framework demonstrating coverage of all six repository-specified elements (framework, risk tolerance, strategy, independent control/assurance, audit follow-up, framework reviews). Simplified regime applies to qualifying entities per repository guidelines.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented ICT risk management framework explicitly addressing all six elements per repository keyDescription passage. For entities qualifying under simplified regime per repository guidelines, documented framework containing minimum required elements specified in repository description. Missing evidence remains pending verification.
References
DORA: ICT risk framework and assurance