[non-validated] DORA SFS 3 / SF 0: Protection, access and data security
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented safeguards meeting DORA's proportionality requirements for ICT system protection, identity and access management, authentication, cryptography, data security, physical/environmental controls, and network segregation?
Explanation
[non-validated] Requires entities to implement documented proportionate safeguards covering identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental measures, and network segregation as defined in DORA topic boundaries. Implementation must follow standard or simplified framework based on entity classification. Missing evidence remains pending and does not constitute automatic failure.
Criterion and evidence
Actor: Financial entities and designated critical ICT third-party providers under Regulation (EU) 2022/2554. Scope: ICT systems processing important functions or sensitive data. Evidence period: Current supervisory review period. Required evidence: Documented security policies demonstrating implementation of all seven control areas specified in topic boundaries. Negative criterion: Absence of documented evidence for one or more required control areas. Missing evidence: Pending verification; absence does not constitute automatic failure. Alternatives: Implementation under simplified framework per Article 15(3) for qualifying small entities.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies this criterion?
Documented policies showing implementation of identity/access controls (including least privilege), authentication mechanisms, cryptographic protections, physical/environmental security measures, and network segregation. Must cover all seven control areas specified in topic boundaries.
How are alternative implementations assessed?
Implementation under the simplified framework per DORA Article 15(3) is acceptable for qualifying small entities. Evidence must explicitly reference applicable framework and demonstrate equivalent coverage of all required control areas.
References
DORA: Protection, access and data security