[non-validated] DORA SFS 8 / SF 9: Backup and Restoration Verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented and verified backup and restoration measures for critical ICT functions as required by DORA Article 11(f)?
Explanation
[non-validated] Determine whether the financial entity has established and validated operational backup and restoration processes for critical ICT functions as explicitly required by DORA Article 11(f).
Criterion and evidence
Applies to financial entities under Regulation (EU) 2022/2554 (excluding simplified regime per Article 61). Scope: Backup/restoration measures exclusively for critical ICT functions per Article 11(f). Evidence period: Current operational cycle. Verification requires documented procedures specifying critical functions AND evidence of successful restoration within recovery objectives. Alternatives: No valid alternatives per frozen repository passages; repository solely references Article 11(f) requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence qualifies for backup/restoration verification?
Documented procedures explicitly specifying critical ICT functions covered per Article 11(f) requirements AND verified successful restoration test evidence meeting defined recovery time objectives. Verification reports required; policy documents alone are insufficient.
Are proportionate arrangements permitted for specific entity types?
Repository evidence (keyDescription in DORA area) confirms SFS 9 owns backup/restore controls per fixedArea boundaries, but simplified regime applicability under Article 61 remains unverified against frozen sources. Pending verification against current legal instruments.
References
DORA: ICT business continuity and crisis response