[non-validated] DORA SFS 9 / SF D: Protect Backup Copies
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented and documented protective measures for backup copies to prevent unauthorized access and data breaches as required by the DORA topic boundaries?
Explanation
[non-validated] Assess whether the entity has implemented and documented protective measures for backup copies to prevent unauthorized access and data breaches, as specified in the DORA topic boundaries' 'protection' requirement.
Criterion and evidence
Applies to designated entities under DORA topic boundaries; requires documented evidence of protective measures (e.g., encryption, access controls) for backup copies during the current review period. Pass requires proof of implemented security controls; absence of documentation results in pending status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for protecting backup copies?
Documented implementation of encryption, access controls, physical security measures, or equivalent protective controls that prevent unauthorized access and maintain data integrity per topic boundaries. Evidence must cover the current review period; absence leaves status pending.
References
DORA: Backup, restoration and recovery