[non-validated] DORA SFS 9 / SF B: Backup protection technical controls
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented technical controls to protect backup copies from unauthorized modification and ensure integrity per the DORA topic boundaries' requirement for backup protection?
Explanation
[non-validated] Has the entity implemented documented technical controls to protect backup copies from unauthorized modification and ensure data integrity, as required by the DORA topic boundaries for backup protection?
Criterion and evidence
Actor: Designated entity under the DORA framework per topic boundaries. Scope: Implementation of technical controls for backup copy protection (encryption, access restrictions, integrity verification) as defined under 'segregation and protection' in topic boundaries. Evidence period: Current review period per operational policy. Required evidence: Documented technical configurations demonstrating encryption, access controls and integrity verification mechanisms applied to backup copies. Negative criterion: Evidence confirms absence or ineffective implementation of required protection controls. Missing evidence: Status remains pending until documented proof of implemented controls is provided. Alternatives: No alternatives satisfy the criterion; technical protection controls must be explicitly documented per topic boundaries to prevent unauthorized modification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient technical evidence for backup protection controls?
Documented configurations showing encryption mechanisms, strict access controls (including role-based permissions), and integrity verification processes (e.g., checksums or hash validation) applied to backup copies. Evidence must reference specific technical implementations, not general policy statements.
How are missing or incomplete evidence scenarios handled?
Assessment remains pending until documented proof of implemented controls is provided. Absence of evidence does not equate to failure; the status transitions only upon verified documentation meeting topic boundary requirements.
References
DORA: Backup, restoration and recovery