[non-validated] DORA SFS 9 / SF 0: Restoration Testing Verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated entity conducted and verified restoration tests against defined recovery objectives for critical systems within the current review period per DORA Article 12 requirements?
Explanation
[non-validated] Has the designated critical entity under DORA Regulation (EU) 2022/2554 conducted verified restoration tests against documented recovery objectives for critical systems within the current review period?
Criterion and evidence
Actor: Designated critical entity under DORA Regulation (EU) 2022/2554. Scope: Backup, restoration and recovery systems per DORA Article 12. Evidence period: Current operational review period. Positive: Documented evidence of successful restoration tests meeting recovery time (RTO) and recovery point objectives (RPO). Negative: Evidence shows failed/unverified tests or missing documentation against objectives. Missing evidence: Pending until documented test results are provided. Required evidence: Verification report signed by authorized personnel confirming tests against objectives. Alternatives: No valid alternatives; compliance requires adherence to DORA Article 12 restoration verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of restoration testing?
Documented verification report showing successful test execution against defined recovery time (RTO) and recovery point objectives (RPO) within the review period, signed by authorized personnel. Evidence must specify critical systems covered and testing methodology.
How are missing or expired test results handled?
Insufficient documentation renders the condition pending. Scheduled future tests do not satisfy the requirement. Evidence must be from the current operational review period per DORA Article 12.
References
DORA: Backup, restoration and recovery