[non-validated] DORA SFS 9 / SF 3: Data reconciliation process verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented and documented a process to reconcile recovered information against source data to verify integrity per DORA Article 12 requirements?
Explanation
[non-validated] Has the designated entity documented and verified a process to reconcile recovered information against source data to confirm integrity per DORA Article 12 requirements?
Criterion and evidence
Applies to designated critical entities under Regulation (EU) 2022/2554. Scope: Data reconciliation processes for recovered information per DORA Article 12. Evidence period: Current DORA review period per supervisory authority requirements. Required evidence: Documented reconciliation procedures with verification logs confirming recovered data integrity against source references. Negative evidence: Absence of reconciliation documentation or unverified implementation. Missing evidence: Pending when documentation is incomplete or unaudited. Alternatives: No valid alternatives; explicit reconciliation implementation is mandated by DORA Article 12.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for data reconciliation verification?
Documented reconciliation reports dated within the review period showing verified integrity checks between recovered and source data for critical systems (see fixture-9-3-satisfied). Policy statements without verification logs are insufficient (fixture-9-3-failed). Planned procedures without executed results remain pending (fixture-9-3-pending).
How does entity role affect this requirement?
Applies only to designated critical entities under DORA Regulation (EU) 2022/2554. Non-applicable entities must explicitly document exemption based on regulatory scope boundaries; automatic pass/fail is not permitted.
References
DORA: Backup, restoration and recovery