[non-validated] DORA SFS 3 / SF 5: Physical and Environmental Security Safeguards
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented physical and environmental security safeguards for ICT infrastructure as required under DORA topic boundaries for protection, access and data security?
Explanation
[non-validated] Does the entity implement documented physical access controls, environmental monitoring, and facility security measures for ICT infrastructure as specified in DORA topic boundaries?
Criterion and evidence
Assess entity role (financial/critical provider), applicable framework (standard/simplified), TLPT scope, and evidence covering physical access controls, environmental monitoring systems, and facility protection measures within current supervisory period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence meets the topic boundary requirements?
Documented evidence must demonstrate implemented physical access controls, environmental monitoring, and facility protection measures matching DORA topic description. Pending evidence requires explicit identification of missing documentation; absence of evidence remains pending rather than automatic failure.
Are simplified frameworks acceptable?
Yes, when entity qualifies under simplified regime per topic boundaries. Alternative implementations must still satisfy all required safeguard categories including physical/environmental protections. No deviations from core requirements are permitted.
References
DORA Topic 3: Protection, access and data security