[non-validated] DORA SFS 8 / SF A: ICT Continuity Policy Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented restoration measures within its continuity policy for critical ICT functions as required by DORA Article 11(f)?
Explanation
[non-validated] Has the financial entity documented restoration measures within its continuity policy for critical ICT functions as required by DORA Article 11(f)?
Criterion and evidence
Verify documented continuity policy explicitly specifying restoration measures for critical ICT functions per Regulation (EU) 2022/2554 Article 11(f). Applies to financial entities (excludes simplified regime under Article 61). Evidence period: current operational cycle.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented continuity policy explicitly specifying restoration measures for critical ICT functions per DORA Article 11(f), including recovery objectives and procedures. Entities under simplified regime (Article 61) may implement proportionate measures addressing designated critical functions.
How should missing or contradictory evidence be handled?
Absence of documented restoration measures within continuity policy results in negative assessment. Pending verification status applies when continuity policy documentation is unavailable during review period.
References
DORA: ICT business continuity and crisis response
Regulation (EU) 2022/2554 - Article 11(f)