[non-validated] DORA SFS 4 / SF F: ICT-Risk Technical Standards Implementation (No Generic Maturity Substitution)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity implemented documented ICT-risk technical standards instead of generic maturity scores for controls as defined in the repository topic description covering change, development, and vulnerability management?
Explanation
[non-validated] Has the designated critical entity implemented documented ICT-risk technical standards, rather than generic maturity scores, for ICT change management, secure development, and vulnerability management controls as required by the repository topic description?
Criterion and evidence
Actor: Designated critical entity under DORA scope. Scope: ICT systems during evidence period. Verification requires documented evidence of ICT-risk technical standards (e.g., ENISA ICT Risk Management Standards) for change management, development controls, and vulnerability treatment. Generic maturity scores (e.g., CMMI) are explicitly prohibited per repository topic description. Missing evidence remains pending; no valid alternatives satisfy the requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented references to applicable ICT-risk technical standards (e.g., ENISA v3.1) specifically addressing change management workflows, secure development protocols, and vulnerability treatment mechanisms as defined in repository topic description. CMMI/ISO maturity scores alone are insufficient.
How should missing evidence be handled?
Evidence gaps remain explicitly pending during review. Absence of documentation does not constitute automatic non-compliance but requires active remediation per DORA Article 28(5) obligation reporting framework.
References
DORA: Secure change, development and vulnerability management