[non-validated] DORA SFS 3 / SF 7: Framework Selection Evidence
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity applied the correct standard or simplified security framework for ICT protection measures based on their designated role and size classification per the repository's DORA topic boundaries?
Explanation
[non-validated] Determine if the entity has documented evidence demonstrating application of the correct security framework (standard or simplified) for ICT protection measures, based on their designated role and size classification per repository topic boundaries. Automatic negative outcome is not assumed when evidence is missing.
Criterion and evidence
Actor: Entity subject to repository topic boundaries for Protection, access and data security. Scope: ICT protection measures framework selection per repository description. Evidence period: Current review period per assessment scope. Required evidence: Documented assessment confirming entity role/size classification; Explicit justification for selected security framework matching classification. Negative criterion: Incorrect framework application or absence of documented justification. Missing evidence: Evidence request remains pending; automatic negative outcome not assumed. Alternatives: None; framework applicability strictly defined by entity role/size per repository description (DORA Article 15).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What documentation qualifies as sufficient evidence for framework selection?
Evidence must include documented assessment of entity role/size classification per repository criteria and explicit justification for selected framework (standard/simplified). Records must cover current review period and demonstrate alignment with repository topic description boundaries. No alternatives satisfy the criterion; framework applicability is strictly defined by DORA Article 15 and repository boundaries.
References
DORA: Protection, access and data security