[non-validated] DORA SFS 9 / SF E (unverified draft)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity provided documented evidence demonstrating successful execution of backup restoration and recovery procedures during actual incidents against defined objectives within the review period?
Explanation
[non-validated] Has the entity provided documented evidence demonstrating successful backup restoration and recovery during actual incidents against defined objectives within the review period?
Criterion and evidence
Assess documented evidence of restoration/recovery execution during actual incidents against stated objectives. Scope: entity role per DORA framework, evidence period matching operational policy. No verified regulatory sources; based solely on repository template requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Documented proof of successful restoration/recovery during actual incidents against defined objectives. Evidence must demonstrate real operational recovery (distinct from scheduled tests covered in SF 4), with measurable RTO/RPO achievement. Pending if evidence absent; no alternatives satisfy the criterion per repository template.
How should missing evidence be handled?
Status remains pending until documented evidence of actual incident execution is provided. Absence cannot be interpreted as negative outcome per repository template's 'missingEvidence' handling.
References
DORA: Backup, restoration and recovery (repository template)