[non-validated] DORA SFS 4 / SF 6: Patching Procedures Compliance
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented patching procedures compliant with DORA Articles 7 and 15, including defined schedules, pre-deployment testing, and post-deployment validation for ICT systems supporting essential services?
Explanation
[non-validated] Has the designated critical entity implemented documented patching procedures for ICT systems supporting essential services, including defined schedules, pre-deployment testing, and post-deployment validation as required by DORA Articles 7 and 15?
Criterion and evidence
Applies to designated critical entities under DORA. Scope covers ICT systems supporting essential services during current compliance review period. Verification requires documented evidence demonstrating established patching schedules, pre-deployment testing protocols, and post-deployment validation records satisfying Articles 7 and 15 requirements. Missing evidence remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence demonstrates compliant patching procedures?
Documented patching policies must explicitly cover defined schedules, pre-deployment testing in staging environments, and post-deployment validation records. Acceptable alternatives include organization-specific documentation meeting all DORA-mandated elements. Missing testing records or validation logs constitute failure.
References
DORA: Secure change, development and vulnerability management