[non-validated] DORA SFS 8 / SF 7: Business Impact Analysis
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented a business impact analysis identifying critical ICT functions and recovery objectives as required by DORA Article 11?
Explanation
[non-validated] Require financial entities to document a business impact analysis that identifies critical ICT functions and associated recovery objectives per DORA Article 11 requirements. Evidence must cover critical function identification and recovery time objectives within the current operational cycle.
Criterion and evidence
Applies to financial entities designated under Regulation (EU) 2022/2554 (excluding simplified regime entities per Article 61). Evidence period: current review cycle. Decision rule: Satisfied when documented business impact analysis specifies critical ICT functions with recovery objectives; Failed when absent or incomplete; Pending when documentation unavailable. Critical ICT functions defined per DORA Article 11 scope.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented business impact analysis report identifying critical ICT functions (e.g., payment processing systems) with specific recovery time objectives (e.g., 2 hours for transaction processing). Simplified regime entities (Article 61) may address only designated critical functions proportionately. Absence of documented objectives constitutes failure.
References
DORA: ICT business continuity and crisis response