[non-validated] DORA: Backup, restoration and recovery - SFS 9 / SF 2: Documented Recovery Objectives
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented specific recovery time and recovery point objectives for critical systems as required by DORA Article 12?
Explanation
[non-validated] Assess whether the entity has documented specific recovery time (RTO) and recovery point (RPO) objectives for critical systems per DORA Article 12 requirements. Evidence must include defined quantified metrics and verification reports; pending if documentation is missing or insufficient.
Criterion and evidence
Actor: Designated critical entity under DORA Regulation (EU) 2022/2554. Scope: Critical systems covered by DORA Article 12. Evidence period: Current DORA review period per supervisory authority requirements. Required evidence: Documented RTO/RPO metrics per Article 12(4); independent verification reports of completed restoration tests. Missing evidence: Pending until quantified metrics and verification reports are provided.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of documented recovery objectives?
Evidence must specify quantified recovery time objective (RTO) and recovery point objective (RPO) metrics for critical systems as defined in Article 12(4); restoration test schedules alone are insufficient without documented metrics.
How is 'missing evidence' handled for this condition?
Status remains pending when documentation lacks quantified RTO/RPO metrics or independent verification reports; unaudited policy summaries or test schedules without metric specifications do not satisfy the requirement.
References
DORA: Backup, restoration and recovery