[non-validated] DORA SFS 4 / SF 5: Vulnerability Treatment Procedures Compliance
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity maintained documented vulnerability treatment procedures covering identification, assessment, remediation, and reporting during the current compliance review period?
Explanation
[non-validated] Does the designated critical entity maintain documented vulnerability treatment procedures covering identification, assessment, remediation, and reporting during the current compliance review period?
Criterion and evidence
Applies to designated critical entities under repository-defined DORA scope. Verification requires documented evidence of vulnerability treatment procedures including identification (e.g., scanning tools), risk assessment (CVSS 3.1), remediation SLAs by severity, and management reporting per repository topic description. Missing evidence remains pending; partial coverage (e.g., lacking reporting mechanisms) constitutes non-compliance per topic boundaries.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented vulnerability management policy (e.g., VT-2026-04 Section 4.3) showing: 1) Identification via automated scanning, 2) Risk assessment using CVSS 3.1, 3) Remediation SLAs based on severity, 4) Management reporting. Evidence must cover current operational period; expired documents or partial implementations (e.g., missing reporting) fail validation.
References
DORA: Secure change, development and vulnerability management