[non-validated] DORA SFS 3 / SF 4: Protection, access and data security
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity implemented proportionate access controls, authentication mechanisms, and data security safeguards for ICT systems as required by DORA Articles 9 and 15?
Explanation
[non-validated] Ensures designated critical entities implement proportionate access controls, authentication mechanisms, and data security safeguards per DORA Articles 9 and 15. Requires documented evidence covering seven control areas: identity/access management, authentication, least privilege, cryptography, data security, physical/environmental protections, and network segregation. Micro-entities may use simplified frameworks with explicit mapping.
Criterion and evidence
Actor: Designated critical entities or ICT third-party providers under Regulation (EU) 2022/2554. Scope: ICT systems processing sensitive data within defined critical functions. Evidence period: Current supervisory review period. Requires documented implementation of all seven control areas specified in topic boundaries. Adherence to standard/simplified framework based on entity size and role. Negative outcome requires absence of documented evidence; missing evidence remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for all seven control areas?
Approved security policy documenting role-based access controls, multi-factor authentication records per Article 9, encryption protocols for data at rest/in transit per Article 15, and network segregation measures. Simplified frameworks require explicit mapping to all seven areas for micro-entities.
How are missing evidence submissions handled?
Pending submission of required documentation; absence of evidence does not automatically trigger negative outcomes. Alternative compliance proofs must explicitly cover all seven control areas within the review period.
References
DORA: Protection, access and data security (repository source)