[non-validated] DORA SFS 8 / SF 5: Crisis Management Procedures for Critical ICT Functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented crisis management procedures for critical ICT functions as required by DORA Article 11?
Explanation
[non-validated] Has the entity established documented crisis management procedures for critical ICT functions, as mandated by DORA Article 11?
Criterion and evidence
Verify existence of documented crisis management procedures addressing critical ICT functions under DORA Article 11, covering role assignments, communication channels, and dependencies. Applicable to financial entities per Regulation (EU) 2022/2554 excluding simplified regime entities per Article 61. Evidence must cover current operational cycle.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of crisis management procedures?
Documented evidence showing crisis management procedures for critical ICT functions during cyber incidents, including role assignments and communication channels (e.g., 2026 crisis management plan for payment processing systems). Absence of these elements constitutes failure. Pending when documentation unavailable.
How does the simplified regime (Article 61) affect this requirement?
Entities under simplified regime must implement proportionate arrangements addressing only designated critical functions. Standard regime entities require full documentation covering all critical ICT functions as defined in Article 11.
References
DORA: ICT business continuity and crisis response