[non-validated] DORA SFS 2 / SF 1: ICT Dependency Mapping for Critical Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented ICT dependency maps showing clear relationships between critical business functions and supporting ICT assets as required by DORA Article 7?
Explanation
[non-validated] Has the financial entity documented ICT dependency maps showing clear relationships between critical business functions and supporting ICT assets as required by DORA Article 7?
Criterion and evidence
Actor: Financial entity under DORA Article 3 definitions. Scope: ICT dependency mappings for assets supporting critical or important functions per DORA Articles 7 and 8. Evidence period: Current regulatory oversight cycle per DORA requirements. Required evidence: Documented dependency maps demonstrating explicit relationships between critical business functions and supporting ICT assets. Negative criterion: Incomplete coverage of critical functions or absence of dependency documentation. Missing evidence: Pending verification when requested documentation is unavailable. Alternatives: No valid alternatives; only entity-maintained dependency maps meeting DORA Article 7 criteria satisfy the requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented dependency maps explicitly linking critical business functions to supporting ICT assets per DORA Article 7. Evidence must demonstrate coverage of all critical functions with specified ICT dependencies. No valid alternatives satisfy this requirement; missing evidence remains pending verification.
References
DORA: ICT assets, services and dependency mapping