[non-validated] DORA SFS 3 / SF 6: Network Segregation Measures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented network segregation measures for ICT systems as defined in the repository's 'DORA: Protection, access and data security' topic boundaries?
Explanation
[non-validated] Does the entity implement documented network segregation measures for ICT systems as defined within the repository's topic boundaries for Protection, access and data security?
Criterion and evidence
Applies to entities within repository-defined scope for ICT systems; requires proportionate network segregation measures (e.g., firewalls, VLANs, air-gapped networks) per repository topic description. Evidence: documented network architecture demonstrating implemented segregation meeting repository requirements. Alternatives: Implementation under simplified framework per repository topic description with documented justification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence should be checked?
Documented network architecture (e.g., firewalls, VLANs, air-gapped networks) demonstrating implemented segregation meeting repository topic description requirements. Evidence must validate design and implementation of segregation controls for ICT systems.
How are missing records handled?
Evidence request remains pending; automatic negative outcome not assumed. Entity must provide documentation satisfying repository topic description within the review period per assessment scope.
References
DORA: Protection, access and data security