[non-validated] DORA SFS 4 / SF A: Acquisition and Development Controls [REPO ALLOCATION]
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented acquisition and development controls as defined in the repository topic description, including requirement specifications, secure coding practices, and pre-deployment testing for ICT systems supporting essential services?
Explanation
[non-validated] Assesses whether the entity follows repository-defined implementation controls per the curated DORA topic allocation, covering acquisition and development controls for ICT systems supporting essential services as described in repository templates. Does not represent verified legal mandate.
Criterion and evidence
Relates to repository-defined scope in topic allocation; verify against actual Regulation (EU) 2022/2554 for legal mandates. Evidence period: current operational review period. Missing evidence remains pending; no negative finding implied.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence under this draft?
Repository-defined documentation demonstrating acquisition and development controls as per the curated topic description. Actual legal verification requires external sources due to RAG_MODE=repo-only limitations.
Why are DORA article references omitted?
Frozen repository sources lack verified Regulation (EU) 2022/2554 text. References to Articles 7/9 were unsupported per rule 'no-false-source-verification' since pinned sources carry 'no legal verification' jurisdiction status. Legal mandates require external verification.
References
DORA: Secure change, development and vulnerability management [REPO ALLOCATION]