[non-validated] DORA SFS 3 / SF 1: fields pending
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Does the entity implement identity and access management controls requiring multi-factor authentication for privileged ICT system access under DORA Article 9?
Explanation
[non-validated] Supporting fields await model review. Proposed positive criterion: Documented implementation of multi-factor authentication for privileged accounts meeting proportionality requirements
Criterion and evidence
Actor: Financial entities and designated critical ICT third-party service providers subject to DORA. Scope: Privileged access to ICT systems processing important functions or sensitive data. Evidence period: Current operational period covered by latest system audit. Required evidence: Current access control policy requiring multi-factor authentication for privileged accounts; Technical evidence of authentication system configuration. Negative criterion: No evidence of multi-factor authentication implementation for privileged access. Missing evidence: Pending submission of current access control policy documentation; absence of evidence does not constitute automatic failure. Alternatives: Explicit documented exemption approved by competent authority under DORA Article 5(3)
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.