[non-validated] DORA SFS 3 / SF 8: Proportionate access, data and network safeguards
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented proportionate access, data and network safeguards for its ICT systems and information, covering identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation, under the relevant standard or simplified framework?
Explanation
[non-validated] Has the entity documented proportionate access, data and network safeguards for its ICT systems and information, covering identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation, under the relevant standard or simplified framework? This draft question is derived from the pinned repository topic description; it is not an operational assessment, legal compliance determination, or human approval. Missing documentation is treated as pending, not as an automatic negative outcome.
Criterion and evidence
Verify documented proportionate safeguards covering identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation for all ICT systems and information owned, operated or maintained by the entity, applied under the relevant standard framework or the simplified framework. Evidence period is the current supervisory or review period. A positive finding requires documented policies, procedures or records covering all seven topic-boundary controls; a negative finding requires absence of such documentation or documented safeguards omitting one or more control areas. Missing evidence is pending and does not automatically constitute a negative outcome. Alternatives qualifying as equivalent coverage include the simplified framework for qualifying entities or a recognized security framework with documented mapping to each control area.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What entity roles and frameworks are covered by this question?
The question applies to financial entities, ordinary ICT third-party providers, and designated critical providers under Regulation (EU) 2022/2554, as applicable to the SFS 3 topic. The relevant standard framework applies to larger or systemically important entities; the simplified framework applies to qualifying smaller or less complex entities. Each entity must identify its applicable framework and document safeguards accordingly.
What evidence is required to show the safeguards are documented?
Documented evidence may include a policies or procedures document covering role-based access controls and least privilege implementation, authentication records including multi-factor authentication where required, cryptography documentation covering protocols and standards for data at rest and in transit with key management, physical and environmental security documentation for ICT system locations, and network segregation design and implementation documentation. The evidence must cover all seven topic-boundary control areas: identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards, and network segregation.
How is a pass or fail determined, and what happens when evidence is missing?
A positive finding requires documented evidence showing proportionate safeguards covering all topic-boundary controls. A negative finding requires absence of documented safeguards or documented safeguards that omit one or more control areas. When required documentation has not been submitted or retrieved, the position is pending; a pending status does not automatically constitute a negative outcome. A schedule or plan alone does not establish that safeguards are documented or implemented.
What alternatives qualify as equivalent coverage?
Two valid, non-mutually-exclusive equivalent evidence paths exist: implementation under the simplified framework per the repository topic description when the entity qualifies for proportionate treatment, or implementation of equivalent safeguards via a recognized security framework or scheme that covers all stated topic-boundary controls, with documented mapping to each control area. The alternatives array does not claim exhaustion of all possible equivalents.
References
DORA: Protection, access and data security