[non-validated] DORA SFS 2: ICT Asset Management Policy Implementation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented documented ICT asset management policies covering critical business functions as required by DORA?
Explanation
[non-validated] Assesses whether the financial entity has implemented documented ICT asset management policies as required under DORA Commission Delegated Regulation (EU) 2024/1532 Article 7, forming part of their ICT security policies to ensure digital operational resilience.
Criterion and evidence
Financial entities must develop and implement an ICT asset management policy as part of their ICT security policies per Commission Delegated Regulation (EU) 2024/1532 Article 7. Pass: documented policy exists. Fail: absence of policy documentation. Pending: unavailable evidence during review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Documented ICT asset management policy integrated within ICT security policies, per Commission Delegated Regulation (EU) 2024/1532 Article 7. Evidence must demonstrate policy existence without requiring specific components (e.g., dependency maps) explicitly stated in this article.
How are alternatives assessed?
Alternative implementations must provide equivalent digital operational resilience through documented asset management policies. Solutions failing to address ICT asset management requirements per Article 7 are invalid, while scope limitations to non-critical systems remain unaddressed in this specific regulatory text.
References
DORA: ICT assets, services and dependency mapping