[non-validated] DORA SFS 9 / SF 4: Restoration Testing Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity conducted and documented successful restoration tests against defined recovery objectives for critical systems within the review period?
Explanation
[non-validated] Has the designated digital service provider conducted and documented successful restoration tests for critical systems within defined recovery time and recovery point objectives during the review period, per DORA Article 12 requirements?
Criterion and evidence
Applies to designated digital service providers under Regulation (EU) 2022/2554. Verify documented evidence of restoration tests meeting recovery time objective (RTO) and recovery point objective (RPO) for critical systems within the operational policy's review period. Missing evidence remains pending; no valid alternatives exist.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence demonstrates compliance with this requirement?
Documented test reports showing restoration completed within defined RTO/RPO for critical systems (e.g., test dated 2026-10-01 confirming 2-hour RTO and 15-minute RPO), per Article 12 implementation standards.
When would evidence be insufficient?
Results exceeding recovery objectives (e.g., tests exceeding RTO by 300%) or absence of documented test results despite request, as verified through official system records.
How are missing records handled?
Assessment remains explicitly pending until documented test evidence is provided; status is not presumed negative due to missing records.
References
DORA: Backup, restoration and recovery