[non-validated] DORA SFS 2 / SF F: ICT Dependency Maps for Critical Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented ICT dependency maps explicitly covering information assets supporting critical business functions as required by DORA Article 7?
Explanation
[non-validated] Does the financial entity maintain documented ICT dependency maps explicitly covering information assets (such as customer data) supporting critical business functions, as required by DORA Article 7?
Criterion and evidence
Actor: Financial entity under DORA Article 3 definitions. Scope: ICT dependency maps must explicitly include information assets supporting critical business functions per Regulation (EU) 2022/2554 Article 7. Evidence period: Current regulatory oversight cycle. Required evidence: Documented maps demonstrating integration of information assets with critical functions. Negative: Coverage limited to hardware/technical assets without information assets. Missing evidence: Pending verification when requested documentation is unavailable.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Documented dependency map showing integration of information assets (e.g., customer transaction data) supporting critical payment processing functions per DORA Article 7, with explicit asset-function relationships.
When would this condition be considered unmet?
Dependency map covers hardware/network assets but omits information assets (e.g., customer data) supporting online banking functions, creating undocumented failure points in critical operations.
How is missing evidence treated?
Pending verification status when formal requests for dependency mapping documentation remain unanswered; absence of evidence does not constitute automatic failure but requires follow-up.
References
DORA: ICT assets, services and dependency mapping