[non-validated] DORA SFS 4 / SF 9: Authorization workflows for ICT change
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity implemented documented authorization workflows for ICT change approvals compliant with DORA Articles 7 and 9 during the evidence period?
Explanation
[non-validated] Does the designated critical entity maintain documented authorization workflows specifying role-based access controls and approval hierarchies for ICT change approvals, as required under DORA Articles 7 and 9 during the current compliance review period? Missing evidence remains pending and does not constitute an automatic negative finding.
Criterion and evidence
Actor: Designated critical entity under DORA (Regulation (EU) 2022/2554). Scope: ICT systems supporting essential services during evidence period (current operational period covered by DORA compliance review). Required evidence: Documented authorization workflows specifying role-based access controls and approval hierarchies aligned with repository topic boundaries (keyDescription element 'change approval'). Negative criterion: Missing documentation covering mandated authorization control elements. Missing evidence: Pending collection; not equivalent to negative finding. Alternatives: Organization-specific authorization procedures may satisfy requirements if they comprehensively cover role-based access controls and approval hierarchies per topic boundaries.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for authorization workflows under DORA?
Documented proof must specify role-based access controls and approval hierarchies directly tied to ICT change procedures, meeting repository topic boundaries (keyDescription). Generic references to 'change management processes' without authorization workflow details are insufficient.
How are missing evidence cases handled?
Missing documentation remains pending evidence collection per topic boundaries; it is not equivalent to a negative finding. An incomplete authorization framework lacking specified role definitions does not satisfy requirements.
References
DORA: Secure change, development and vulnerability management