[non-validated] DORA SFS 8 / SF 2: Continuity Policy for Critical ICT Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented a continuity policy addressing critical ICT functions and disruptive scenarios as required by DORA Article 11?
Explanation
[non-validated] Has the financial entity documented a continuity policy addressing critical ICT functions and disruptive scenarios as required by DORA Article 11, excluding entities under the simplified regime per Article 61?
Criterion and evidence
Applies to financial entities designated under Regulation (EU) 2022/2554 (excluding simplified regime entities per Article 61). Scope: Continuity policy addressing critical ICT functions and disruptive scenarios per DORA Article 11 requirements. Evidence period: Current operational cycle. Pass: Documented policy meeting Article 11 criteria; Fail: Absence of compliant documentation; Missing evidence: Pending verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Documented continuity policy explicitly addressing critical ICT functions and disruptive scenarios as required by DORA Article 11, applicable to financial entities under standard regime (excludes simplified regime per Article 61). Evidence must cover current operational cycle. Absence constitutes failure; missing documentation remains pending.
References
DORA: ICT business continuity and crisis response