[non-validated] DORA SFS 3 / SF B: Cryptographic Safeguards
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented cryptographic safeguards for data at rest and in transit as required by the DORA topic boundaries?
Explanation
[non-validated] Has the entity implemented documented cryptographic safeguards for data at rest and in transit as defined in the repository's 'DORA: Protection, access and data security' topic boundaries?
Criterion and evidence
Entity subject to DORA framework per repository topic boundaries. Scope covers ICT systems processing sensitive financial data under repository-defined critical functions. Evidence period aligns with current review cycle. Pass requires documented cryptographic protocols matching repository topic description requirements. Fail occurs with absent controls. Pending status for missing evidence; no automatic negative outcome. Alternatives: Implementation under simplified framework per repository topic description for qualifying entities.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes valid evidence for cryptographic safeguards?
Documented cryptographic protocols (e.g., TLS 1.3+, AES-256) validated through configuration reviews matching repository topic description requirements. For simplified framework entities, documented risk assessment showing proportionate cryptographic measures suffices. Evidence must cover both data at rest (storage encryption) and data in transit (transport encryption) per repository-defined scope.
How does proportionality affect this requirement?
Entity type determines framework application under repository topic description: standard framework entities require robust cryptographic standards; simplified framework entities must demonstrate risk-appropriate measures but cannot omit cryptographic protection entirely for sensitive financial data. Evidence stringency varies by framework.
References
DORA: Protection, access and data security