[non-validated] DORA SFS 9 / SF A: Backup Scope Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented the scope of critical systems and data included in backup procedures as required by the DORA topic boundaries?
Explanation
[non-validated] Has the entity documented which critical systems and data are explicitly included in its backup procedures, as required by the DORA topic boundaries for backup scope definition?
Criterion and evidence
Designated entities under the DORA framework as defined in the topic boundaries must document the scope of critical systems/data covered by backup procedures during the current review period. Evidence: explicit listing of critical systems/data categories matching topic boundaries. Missing evidence remains pending; no alternatives satisfy this mandatory documentation requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for backup scope documentation?
Documented evidence must explicitly name critical systems/data categories (e.g., customer databases, transaction processing modules) covered by backups. Vague statements like 'all systems backed up' without classification are insufficient per topic boundaries.
Are alternatives accepted for demonstrating backup scope coverage?
No valid alternatives exist; explicit documentation of critical systems/data inclusion is mandatory per topic boundaries. Absence of defined scope automatically fails verification until proper documentation is provided.
References
DORA: Backup, restoration and recovery