[non-validated] DORA SFS 9 / SF 7: Documented RTO and RPO Specifications
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented recovery priority rankings specifying critical system recovery sequence tiers during outages per repository topic boundaries?
Explanation
[non-validated] Has the entity documented recovery time objectives (RTO) and recovery point objectives (RPO) for critical systems per DORA Article 12 requirements?
Criterion and evidence
Verification of documented recovery time objectives (RTO) and recovery point objectives (RPO) specifications for critical systems per DORA Regulation (EU) 2022/2554 Article 12 requirements
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes documented recovery objectives under DORA?
Documented quantitative timeframes (e.g., '4-hour RTO, 15-minute RPO') explicitly mapped to critical systems per DORA Article 12(4). Policy statements without measurable targets don't satisfy.
References
DORA: Backup, restoration and recovery