[non-validated] DORA SFS 3 / SF D: Access Permission Reviews
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity conducted and documented regular reviews of user access permissions to ensure alignment with current roles and responsibilities under DORA Article 9?
Explanation
[non-validated] Has the entity conducted and documented regular reviews of user access permissions to ensure alignment with current roles and responsibilities as required by DORA Article 9 for financial entities and designated critical ICT third-party providers?
Criterion and evidence
Actor: Financial entities and designated critical ICT third-party service providers under Regulation (EU) 2022/2554. Scope: User access permissions for ICT systems processing important functions or sensitive data within operational scope. Evidence period: Current supervisory review period. Required evidence: Documented access review policy with specified frequency/scopes; current records verifying role alignment for all active accounts. Negative: Absence of documented evidence meeting DORA requirements. Missing evidence: Pending verification; absence ≠ automatic failure. Alternatives: Implementation under simplified framework per DORA Article 15(3) with documented justification for qualifying small entities.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for access permission reviews?
Documented policy specifying review frequency/scope criteria and current records demonstrating verified role alignment for all active accounts within the review period. Records must include remediation actions for discrepancies.
How are missing evidence scenarios handled?
Evidence requests with no response remain pending; absence of evidence does not automatically constitute failure. Remediation window continues until evidence submission or review period closure.
References
DORA: Protection, access and data security