[non-validated] DORA SFS 3 / SF A: Proportionality Determination for Security Safeguards
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented the basis for determining that its access, data, and network security safeguards are proportionate to its designated entity role, size, and critical function scope as required under the DORA topic boundaries?
Explanation
[non-validated] Has the entity documented the basis for determining that its access, data, and network security safeguards are proportionate to its designated entity role, size, and critical function scope as specified in the repository's 'DORA: Protection, access and data security' topic boundaries, applicable to its designated entity role and framework?
Criterion and evidence
Verify implementation of proportionate safeguards covering identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation meeting repository topic description requirements. Evidence must include validated documentation dated within current review period demonstrating proportionality under standard/simplified framework based on entity role, size, and critical function scope.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for proportionality determination?
Documented justification explicitly linking entity role classification, size assessment, and critical function scope to implemented safeguards covering all repository topic description categories (identity/access controls, authentication, least privilege, cryptography, data security, physical/environmental, network segregation), dated within evidence period.
How are missing evidence scenarios handled?
Evidence request remains pending; absence of documentation does not constitute automatic failure. Required submission must address all safeguard categories per repository topic boundaries under applicable framework.
References
DORA: Protection, access and data security