[non-validated] DORA SFS 2 / SF 7: Legacy ICT Systems Risk Assessment Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented risk assessments specifically addressing legacy ICT systems that support critical business functions as required by DORA Article 7?
Explanation
[non-validated] Financial entities must document risk assessments specifically addressing legacy ICT systems that support critical business functions as required by DORA Article 7, confirming operational resilience through legacy system risk management.
Criterion and evidence
Verify compliance with DORA Article 7 via documented risk assessments covering legacy ICT systems supporting critical business functions per Regulation (EU) 2022/2554 and Commission Delegated Regulation (EU) 2024/1532 Article 7. Pass: evidence demonstrates complete legacy system risk coverage. Fail: incomplete critical function coverage or absence of documentation. Missing evidence: pending verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Documented risk assessments explicitly evaluating legacy ICT systems supporting all critical business functions per DORA Article 7 requirements, including mitigation plans for identified risks.
How are legacy systems defined in context?
ICT systems classified as legacy based on end-of-support status or outdated technology that continue to support critical business operations as defined in entity's operational resilience framework.
How is missing evidence handled?
Assessment remains pending verification when requested documentation of legacy system risk assessments is unavailable. No automatic failure occurs without examination of evidence.
References
DORA: ICT assets, services and dependency mapping