[non-validated] DORA SFS 2: ICT Asset Management for Critical Functions (SF 5)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented documented ICT asset management policies specifying critical business functions and their supporting assets as required by DORA Article 7?
Explanation
[non-validated] Has the financial entity implemented documented ICT asset management policies specifying critical business functions and their supporting assets as required by DORA Article 7?
Criterion and evidence
Verify documented ICT asset management policies covering critical business functions per Commission Delegated Regulation (EU) 2024/1532 Article 7 during the review period. Evidence must demonstrate identification of critical functions, supporting assets, and dependency mappings. Excludes non-critical systems documentation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented ICT asset management policies explicitly addressing critical business functions per Commission Delegated Regulation (EU) 2024/1532 Article 7, demonstrating specific identification of critical functions, associated ICT assets, and dependency mappings. Evidence limited to non-critical systems is insufficient.
References
DORA: ICT assets, services and dependency mapping