[non-validated] DORA SFS 4 / SF 8 (ICT System Lifecycle Management)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented ICT system lifecycle management procedures per DORA Articles 7 and 15, including end-of-life planning and maintenance protocols for supported systems during the evidence period?
Explanation
[non-validated] Has the entity implemented documented ICT system lifecycle management procedures per DORA Articles 7 and 15, including end-of-life planning and maintenance protocols for supported systems during the evidence period?
Criterion and evidence
Verification requires documented evidence of ICT lifecycle management covering version control, maintenance schedules, and end-of-life phase-out planning for designated critical entities under DORA (Regulation (EU) 2022/2554) during evidence period. Missing documentation results in pending evidence status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for lifecycle management?
Documented procedures must explicitly cover version maintenance schedules, end-of-life migration processes, and legacy system support protocols aligned with DORA Article 15 requirements. Organization-specific documentation is acceptable when covering all required elements including maintenance and end-of-life planning.
How is missing evidence handled?
Absence of documented evidence results in pending evidence status per changeReason; this does not equate to automatic negative finding. Verification requires current operational documentation covering the entire evidence period.
References
DORA: Secure change, development and vulnerability management