[non-validated] DORA SFS 8 / SF E: Response and Recovery Plans
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented response and recovery plans addressing critical ICT functions and disruptive scenarios as required by DORA Article 11?
Explanation
[non-validated] Has the entity established documented response and recovery plans addressing critical ICT functions and disruptive scenarios as required under DORA Article 11?
Criterion and evidence
Applies to financial entities designated under Regulation (EU) 2022/2554 (excluding simplified regime per Article 61). Requires documented response plans for critical ICT functions during disruptive incidents and recovery procedures ensuring functional resumption. Evidence period: current review cycle corresponding to most recent operational cycle. Positive: documented plans covering critical functions; Negative: absence of compliant documentation; Missing evidence: pending verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for response and recovery plans?
Documented evidence must show specific procedures for critical ICT functions during incidents, including role assignments, escalation protocols, and recovery time objectives. Evidence should align with defined critical functions without substituting mere policy statements.
Are entities under the simplified regime treated differently?
Entities under the simplified regime (Article 61) may implement proportionate response and recovery arrangements addressing only designated critical functions, as specified in DORA Article 61.
References
DORA: ICT business continuity and crisis response