[non-validated] DORA SFS 8 / SF 0: ICT Business Continuity and Crisis Response
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity maintained and tested continuity and response arrangements for critical ICT functions addressing disruptive scenarios as required by DORA Article 11?
Explanation
[non-validated] Has the entity maintained and tested continuity and response arrangements for critical ICT functions addressing disruptive scenarios as required by DORA Article 11? Entities must provide documented evidence of business impact analysis, continuity policy, response/recovery plans, crisis management procedures with activation protocols, and continuity exercises within the operational cycle. Entities under simplified regime (Article 61) may apply proportionate measures to designated critical functions.
Criterion and evidence
Confirm applicability to financial entities under Regulation (EU) 2022/2554 excluding simplified regime entities (Article 61). Verify documented evidence of: business impact analysis identifying critical ICT functions, continuity policy addressing disruptive scenarios, response/recovery plans covering critical functions, crisis management procedures with activation protocols, and continuity exercise evidence. Evidence period: current operational cycle. Exclude non-critical functions, backup/restore controls (SFS 9), and wider resilience testing (SFS B). Satisfied: complete documentation; failed: missing elements; pending: unavailable evidence.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of compliance?
Documented business continuity policy including business impact analysis identifying critical functions, continuity policy addressing disruptive scenarios, response/recovery plans covering critical functions, crisis management procedures with clear activation protocols, and evidence of continuity exercises conducted within the operational cycle. Simplified regime entities (Article 61) may implement proportionate arrangements for designated critical functions only.
How are disruptive scenarios defined for this requirement?
Realistic threats identified in business impact analysis that could significantly impact critical ICT functions, requiring documented response and recovery measures. Must reflect actual vulnerabilities to essential services with specified activation protocols. Excludes scenarios affecting non-critical functions.
References
DORA: ICT business continuity and crisis response