[non-validated] DORA SFS 8 / SF 3: Continuity Policy for Critical ICT Functions (Excluding Backup)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented continuity policy addressing response and recovery procedures for critical ICT functions during disruptive scenarios as required by DORA Article 11?
Explanation
[non-validated] Has the entity implemented documented business continuity plans covering response and recovery procedures for critical ICT functions during disruptive scenarios as required by DORA Article 11(f)?
Criterion and evidence
Applies to financial entities designated under Regulation (EU) 2022/2554 (excluding simplified regime entities per Article 61). Scope: Continuity policy addressing response/recovery procedures for critical ICT functions per DORA Article 11, excluding backup/restoration controls (SFS 9 responsibility). Evidence period: current operational cycle. Pass requires documented evidence meeting Article 11 requirements; absence constitutes failure; missing documentation remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Documented business continuity policy addressing critical ICT functions with response and recovery procedures meeting Article 11 requirements. Excludes backup/restoration controls (SFS 9 responsibility). Proportionate arrangements permitted for simplified regime entities (Article 61).
How is 'critical ICT functions' defined for this assessment?
Refers to ICT functions whose disruption would significantly impact service continuity for end-users or financial stability, as defined in DORA Article 4(26) and regulatory guidance.
References
DORA: ICT business continuity and crisis response