[non-validated] DORA SFS 8 / SF 6: Critical ICT Function Dependency Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented dependencies between its critical ICT functions within business continuity arrangements as required by DORA Article 11?
Explanation
[non-validated] Has the financial entity documented dependencies between its critical ICT functions within business continuity arrangements as required by DORA Article 11?
Criterion and evidence
Applies to financial entities under Regulation (EU) 2022/2554 excluding simplified regime entities per Article 61. Evidence period: current operational cycle. Decision rule: Satisfied when documented evidence shows identification/management of dependencies between critical ICT functions per Article 11 requirements; failed when absent; pending when documentation unavailable. Valid alternative: Simplified regime entities document dependencies only for designated critical functions.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for dependency documentation?
Documented business continuity arrangements explicitly showing interdependencies between critical ICT functions (e.g., payment processing and core banking systems) including failover protocols. Must cover all critical functions identified per DORA Article 11. Entities under simplified regime (Article 61) may limit documentation to designated critical functions.
How are missing/contradictory records handled?
Absence of documented dependency analysis meeting DORA Article 11 requirements constitutes failure. Unavailable documentation leaves assessment pending. Contradictory records require resolution per entity's applicable regulatory regime.
References
DORA: ICT business continuity and crisis response