[non-validated] DORA SFS 2 / SF 9: Business-function classification for critical/important functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity classified its business functions to identify which are critical or important as required by DORA Article 7?
Explanation
[non-validated] Does the financial entity maintain documented evidence of business-function classification that explicitly identifies which functions are critical or important under DORA Article 7 requirements?
Criterion and evidence
Actor: Financial entity per DORA Article 3 definitions. Scope: Business-function classification process identifying critical/important functions per Regulation (EU) 2022/2554 Article 7. Evidence period: Current regulatory oversight cycle. Required evidence: Documented classification demonstrating explicit identification of critical/important functions. Negative criterion: Incomplete coverage or absence of documented classification. Missing evidence: Pending verification when documentation unavailable. Alternatives: No valid alternatives; only entity-conducted classification meeting DORA Article 7 satisfies requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented evidence showing explicit classification of business functions with clear identification of which are critical or important per DORA Article 7. Must cover all relevant functions and map to supporting assets/dependencies.
How are missing evidence cases handled?
Pending verification status when requested documentation remains unavailable. Absence of evidence does not automatically constitute failure under DORA requirements.
References
DORA: ICT assets, services and dependency mapping