[non-validated] DORA SFS 2 / SF C: ICT Asset Ownership Accountability for Critical Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity maintained documented ICT asset ownership records assigning responsibility for assets supporting critical functions as required by DORA Article 7?
Explanation
[non-validated] Financial entities must maintain documented ICT asset ownership records that clearly assign responsibility for assets supporting critical or important financial functions, as mandated by DORA Article 7.
Criterion and evidence
Applies to financial entities under DORA Article 3 definitions. Requires documented ICT asset ownership records showing assigned responsibility for critical-function assets per DORA Article 7 during current oversight cycle. Evidence period: current review period. No valid alternatives; missing evidence remains pending verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented ICT asset ownership records demonstrating assigned responsibility for all critical-function ICT assets as specified in DORA Article 7. Ownership records must cover business-critical systems and exclude non-essential assets, with clear assignment of accountability.
How should missing or contradictory evidence be handled?
Missing ownership documentation for critical-function assets results in a pending verification status. Partial documentation covering only non-critical systems does not satisfy requirements. Expired records require updated documentation reflecting current critical-function assets.
References
DORA: ICT assets, services and dependency mapping