[non-validated] DORA SFS 2 / SF E: ICT Asset Inventory for Critical Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity maintained a documented ICT asset inventory specifically listing all ICT assets supporting critical or important functions as required by DORA Article 7?
Explanation
[non-validated] Does the financial entity maintain a documented ICT asset inventory specifically listing all assets supporting critical or important functions as required under DORA Article 7?
Criterion and evidence
Assess documented evidence of comprehensive ICT asset inventory covering all systems supporting critical/important functions per DORA Article 7. Applies to financial entities under DORA Article 3 definitions; excludes non-critical systems. Evidence period: current regulatory oversight cycle.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What qualifies as sufficient evidence?
Documented asset inventory demonstrating complete listing of ICT assets supporting critical/important functions per DORA Article 7. Must include business-function classification and system dependencies.
How are non-applicable entities handled?
Explicitly scoped out based on DORA Article 3 definitions. Non-applicability requires documented confirmation of entity classification; it is neither automatic pass nor failure.
References
DORA: ICT assets, services and dependency mapping