[non-validated] DORA SFS 9 / SF F: Backup Scope Verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented verification confirming backup copies include all critical systems and data specified in the documented backup scope for the current review period?
Explanation
[non-validated] Verification that the entity has documented evidence showing all critical systems and data specified in the backup scope are included in backup copies during the current review period. Based on repository template definitions under DORA topic boundaries; not legally verified.
Criterion and evidence
Actor: Designated entity per DORA topic boundaries framework. Scope: Verification of complete critical systems/data inclusion in backup copies as defined in documented scope. Evidence period: Current operational policy review period. Required evidence: Documented verification demonstrating alignment between backup copies and specified critical systems/data. Negative: Omissions identified or absence of verification documentation. Missing evidence: Pending until documented verification of scope coverage is provided. Based solely on repository template without legal/source verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Backup, restoration and recovery. Protect backup copies and demonstrate restoration and recovery against stated objectives. Cover backup scope, segregation and protection, restoration testing, recovery priorities/objectives, redundant capacity and reconciliation of recovered information. Keep business continuity policy in SFS 8 and evidence of real execution separate from proposed procedures. DORA article references: 12. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
Does non-applicability constitute automatic pass/failure?
Explicit scope-out required; non-applicability must be documented per DORA framework rules rather than treated as automatic outcome. Repository template requires role-specific evidence.
How is 'current review period' defined?
Per repository template: Defined operationally in entity's business continuity policy (SFS 8). Pending external verification of period alignment with regulatory requirements.
References
DORA: Backup, restoration and recovery