[non-validated] DORA SFS 2 / SF 4: fields pending
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity maintained documented ICT dependency mapping procedures showing relationships between critical business functions and supporting ICT assets throughout the review period as required by DORA-compliant asset management policies?
Explanation
[non-validated] Supporting fields await model review. Proposed positive criterion: Documented evidence of dependency mappings covering all critical business functions with relationship specifications
Criterion and evidence
Actor: Financial entity under DORA Article 3 definitions. Scope: ICT dependency mapping procedures for assets supporting critical business functions. Evidence period: Current review period per DORA oversight cycle. Required evidence: Documented ICT dependency map showing explicit relationships between critical business functions and supporting ICT assets per Commission Delegated Regulation (EU) 2024/1532 Article 7. Negative criterion: Absence of documented mappings or coverage limited to non-critical functions. Missing evidence: Pending verification when documentation is unavailable. Alternatives: Documented ICT asset management procedures meeting equivalent regulatory requirements may satisfy the condition
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.