[non-validated] DORA SFS 8: ICT Business Continuity and Crisis Response (Activation Protocols) [repo-only]
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented activation protocols specifying triggers and authorization for initiating crisis management procedures during ICT disruptions as required by DORA Article 11?
Explanation
[non-validated] Has the entity documented activation protocols specifying triggers and authorization for initiating crisis management procedures during ICT disruptions, as required for financial entities under Regulation (EU) 2022/2554 excluding simplified regime entities per Article 61?
Criterion and evidence
Actor: Financial entities designated under Regulation (EU) 2022/2554 (excluding simplified regime entities per Article 61). Scope: Activation protocols within business continuity arrangements for critical ICT functions during disruptive scenarios, specifying triggers (e.g., outage duration thresholds) and authorization procedures (e.g., CISO-led approval with backup approvers). Evidence period: Current operational cycle. Pass requires documented evidence meeting repository topic allocation boundaries; absence constitutes failure; missing documentation remains pending. Proportionality applies per Article 61 for simplified regime entities. [Unverified draft guidance; no statutory verification]
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for activation protocols?
Documented triggers (e.g., server outage duration thresholds) and authorization procedures (e.g., CISO-led protocol with backup approvers for payment systems) per repository topic allocation boundaries. Evidence must address critical ICT functions during disruptive scenarios within current operational cycle.
How are missing/unverified documents treated?
Pending verification when documentation is unavailable per repo-only constraints. Absence of documented triggers/authorization protocols constitutes failure. Proportionate arrangements may apply for simplified regime entities per Article 61, but repository templates lack jurisdictional validation.
References
DORA: ICT Business Continuity and Crisis Response [repo-only]