[non-validated] DORA SFS 2: Legacy ICT Systems Risk Management for Critical Operations
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented risk management procedures for legacy ICT systems supporting critical business functions as required by DORA Article 8 per profile allocation?
Explanation
[non-validated] Financial entities must document risk management procedures for legacy ICT systems supporting critical business functions as defined in the repository profile allocation for legacy-system risk assessment.
Criterion and evidence
Applies to financial entities under DORA Article 3 definitions. Requires documented evidence of legacy ICT systems risk management procedures covering critical business functions per repository profile allocation during the current oversight cycle. Absence of documentation constitutes non-compliance; pending verification when evidence is unavailable.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What qualifies as sufficient evidence for compliance?
Documented evidence of legacy ICT systems risk management procedures explicitly addressing critical business functions per repository profile allocation (2-repository-area#keyDescription). Evidence must cover legacy-system risk assessment as specified in SFS 2 boundaries, not requiring Article 8 references.
References
DORA: ICT assets, services and dependency mapping