[non-validated] DORA SFS 4 / SF 3: Secure Change, Development and Vulnerability Management (Repository Allocation)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented ICT change, development, and vulnerability management controls per DORA Articles 7, 9, and 15 covering acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment, and system lifecycle management during the evidence period?
Explanation
[non-validated] Assesses whether the organization maintains documented processes for managing ICT changes, software development, vulnerabilities, and patching per the curated DORA topic allocation, covering acquisition controls, pre-deployment testing, change approval workflows, emergency change handling, patching procedures, vulnerability treatment, and supported-system lifecycle management as described in repository templates. Does not represent verified legal mandate.
Criterion and evidence
Verify documented implementation of ICT change, development, and vulnerability management controls per repository-defined topic allocation (referencing DORA Articles 7, 9, 15 in template). Evidence must cover acquisition/development controls, pre-deployment testing protocols, formal change approval processes, emergency change procedures, patching schedules, vulnerability treatment workflows, and supported-system lifecycle management as specified in repository documentation. Generic maturity scores are insufficient; requires alignment with specified ICT-risk technical standards per repository definitions. Does not verify current legal applicability.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for the repository-defined criterion?
Documented procedures demonstrating coverage of all required elements: acquisition/development controls, pre-deployment testing, change approval workflows, emergency change handling, patching schedules, vulnerability treatment processes, and supported-system lifecycle management as defined in repository topic allocation. Generic maturity assessments are not acceptable substitutes. Does not verify legal compliance.
References
DORA: Secure change, development and vulnerability management