[non-validated] DORA SFS 3 / SF F: Security Framework Application
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity applied the correct standard or simplified security framework for ICT protection measures as defined in the repository's 'DORA: Protection, access and data security' topic boundaries based on their designated role and size?
Explanation
[non-validated] Has the entity applied the correct standard or simplified security framework for ICT protection measures as defined in DORA based on their designated role and size classification?
Criterion and evidence
Validate entity-specific application of DORA-mandated security framework (standard/simplified) per Article 15; evidence period: current review cycle; assess role/size alignment with prescribed requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for framework application verification?
Documented evidence confirming framework selection methodology aligned with entity role/size per DORA Article 15; must include dated policy documents or implementation records showing clear application of prescribed safeguards.
How are entity roles and size classifications determined under DORA?
Based on regulatory definitions and national implementation specifics; micro/small entities may qualify for simplified framework where explicitly permitted by supervisory authority under Article 15(2). Missing classification documentation creates evidence gap.
References
DORA: Protection, access and data security