[non-validated] DORA SFS 4 / SF 7: Supported-System Lifecycle Management
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity implemented documented ICT system lifecycle management procedures per DORA Articles 7 and 15, including end-of-life planning and maintenance protocols for supported systems during the evidence period?
Explanation
[non-validated] Does the designated critical entity maintain documented ICT system lifecycle management procedures covering version control, maintenance schedules, and end-of-life planning for supported systems under DORA Articles 7, 9, and 15 during the evidence period? Missing evidence remains pending; no automatic negative finding applies.
Criterion and evidence
Verification requires documented evidence of ICT lifecycle management (DORA Arts. 7, 9, 15) covering: (1) version control protocols, (2) scheduled maintenance procedures, and (3) end-of-life phase-out planning for ICT systems supporting essential services. Applies exclusively to designated critical entities during evidence period. Missing any element constitutes non-compliance per topic boundaries; pending evidence retains placeholder status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What specific evidence validates compliance with this requirement?
Documented procedures must explicitly cover all three elements: version control (e.g., change logs), maintenance schedules (e.g., quarterly reviews), and end-of-life planning (e.g., phase-out protocols). Generic maturity scores are insufficient. Evidence must be current to the evidence period per repository topic description.
When does missing evidence result in a negative finding?
Failure occurs only if documentation is confirmed missing for any required element. Partial evidence (e.g., having version control without end-of-life planning) constitutes non-compliance. Unverified or pending evidence retains 'pending' status; no automatic negative applies per topic boundaries.
References
DORA: Secure change, development and vulnerability management