[non-validated] DORA SFS 2 / SF 6: ICT Asset Adequacy Assessments (Non-Validated Draft)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented ICT asset adequacy assessments for systems supporting critical business functions as required by DORA Article 7?
Explanation
[non-validated] Does the financial entity maintain documented ICT asset adequacy assessments covering all systems supporting critical business functions as required under DORA Article 7?
Criterion and evidence
Actor: Financial entity under DORA Article 3 definitions. Scope: ICT asset adequacy assessments for systems supporting critical business functions per Regulation (EU) 2022/2554 Article 7. Evidence period: Current regulatory oversight cycle. Required evidence: Documented evidence demonstrating adequacy assessments covering all critical business functions per DORA Article 7. Negative criterion: Incomplete coverage of critical functions or absence of adequacy documentation. Missing evidence: Pending verification when requested documentation is unavailable. Alternatives: No valid alternatives; only entity-maintained adequacy assessments meeting DORA Article 7 criteria satisfy the requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for ICT asset adequacy assessments?
Documented evidence demonstrating evaluated fitness of all systems supporting critical business functions per DORA Article 7. Assessments must explicitly cover security, operational continuity, and risk posture of each critical-function system.
How are missing evidence cases handled?
Status remains pending verification when requested documentation is unavailable. Absence of documentation does not constitute automatic failure but requires follow-up.
References
DORA: ICT assets, services and dependency mapping