[non-validated] DORA SFS 8 / SF C: Continuity exercises for critical ICT functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity provided documented evidence of successfully conducted continuity exercises for critical ICT functions addressing disruptive scenarios as required by DORA Article 11?
Explanation
[non-validated] Has the financial entity provided documented evidence of successfully conducted continuity exercises for critical ICT functions addressing disruptive scenarios, as required by DORA Article 11?
Criterion and evidence
Applies to financial entities under Regulation (EU) 2022/2554 excluding simplified regime (Article 61). Evidence must demonstrate completed continuity exercises for critical ICT functions during disruptive scenarios within current operational cycle. Pass: documented exercise results meeting Article 11; Fail: absence of compliant evidence; Pending: missing documentation. Alternatives: Simplified regime entities apply proportionate arrangements covering only designated critical functions.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for continuity exercises?
Documented results demonstrating successful execution of continuity exercises for critical ICT functions during disruptive scenarios, including coverage of disruptive scenarios identified in business impact analysis. Evidence must relate to current operational cycle.
How are simplified regime entities treated?
Entities under simplified regime (Article 61) may implement proportionate arrangements with reduced scope, addressing only designated critical functions rather than full continuity exercise requirements.
References
DORA: ICT business continuity and crisis response