[non-validated] DORA SFS 4 / SF C: Implementation per Repository Topic Description
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity implemented documented ICT-risk technical standards instead of generic maturity scores for controls as defined in the repository topic description covering change, development, and vulnerability management?
Explanation
[non-validated] Does the designated critical entity use documented ICT-risk technical standards as specified in the repository topic description for managing ICT changes, development, vulnerabilities, and patching in critical systems, rather than generic maturity scores?
Criterion and evidence
Verify documented application of ICT-risk technical standards per repository topic description to change management, secure development, vulnerability treatment, and patching processes for ICT systems supporting essential services. Evidence must reference specified standards rather than generic maturity frameworks without external article citations.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented references to applicable ICT-risk technical standards as specified in the repository topic description in security policies, explicitly prohibiting substitution with generic maturity scores. Internal audit evidence must cite the repository-specified requirements rather than external frameworks.
How is missing evidence treated?
Pending evidence collection status; not equivalent to negative finding. Remediation plans must specify the repository-specified ICT-risk technical standards to be implemented within defined timelines.
References
DORA: Secure change, development and vulnerability management