[non-validated] DORA SFS 2: ICT Asset Ownership for Critical Business Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented clear ownership assignments for all ICT assets supporting critical business functions as required by DORA Article 7?
Explanation
[non-validated] Does the financial entity maintain documented ICT asset ownership records assigning clear responsibility for all assets supporting critical business functions as required by DORA Article 7?
Criterion and evidence
Actor: Financial entity under DORA Article 3 definitions. Scope: ICT asset ownership assignments for assets supporting critical or important functions during current regulatory oversight cycle. Evidence period: Current oversight cycle per DORA requirements. Required evidence: Documented ownership records specifying responsible parties per DORA Article 7. Negative: Incomplete coverage or absence of documentation. Missing evidence: Pending verification when documentation is unavailable. Alternatives: No valid alternatives; only entity-maintained ownership documentation meeting DORA Article 7 criteria satisfies the requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence should be verified?
Official records showing named responsible parties for each ICT asset supporting critical business functions, per DORA Article 7 requirements during the oversight cycle.
When does evidence fail verification?
When documentation omits ownership assignments for critical-function assets or lacks responsible-party specifications; legacy system coverage gaps also invalidate evidence.
How are missing records handled?
Verification status remains pending when ownership documentation is unavailable; absence does not constitute automatic failure but prevents positive assessment.
References
DORA: ICT assets, services and dependency mapping