[non-validated] DORA SFS 8 / SF 1: Activation Protocols for Crisis Management
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented activation protocols specifying triggers and authorization for initiating crisis management procedures during ICT disruptions as required by DORA Article 11?
Explanation
[non-validated] Has the entity documented activation protocols specifying triggers and authorization procedures for initiating crisis management during ICT disruptions, as outlined in DORA Article 11 requirements?
Criterion and evidence
Applies to financial entities under Regulation (EU) 2022/2554 excluding simplified regime entities (Article 61). Scope: Activation protocols within business continuity arrangements for critical ICT functions during disruptive scenarios. Evidence period: Current operational cycle. Satisfied when documented triggers and authorization procedures exist; failed when absent; pending when documentation unavailable. Distinct from crisis management procedures (SFS 5) and resilience testing framework (SFS B).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence should be checked for activation protocols?
Documented identification of specific triggers (e.g., outage duration thresholds) and authorization procedures (e.g., defined roles/escalation paths) for critical ICT functions. Absence constitutes failure; missing documentation remains pending.
References
DORA: ICT business continuity and crisis response