[non-validated] DORA Article 24: Findings Register Closure Verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity maintained a findings register with documented verification that all identified test issues were remediated within contractual timelines during the review period?
Explanation
[non-validated] Has the entity maintained a findings register with documented evidence that all identified test issues were remediated within contractual timelines during the review period?
Criterion and evidence
For designated digital service providers under DORA Article 24, verify evidence of a findings register demonstrating remediation of all test issues within specified contractual timelines during the review period as defined in repository documentation. Distinguish from the advanced TLPT regime covered in SFS C. Missing evidence remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of closure?
Documented findings register showing completion records within contractual timelines; partial remediation or expired deadlines constitute failure. Pending when closure evidence is absent.
How does this differ from SFS C requirements?
This SFS covers basic testing program closure under Article 24; SFS C addresses the advanced TLPT regime with different scope and timelines per Article 25.
References
DORA: Digital operational resilience testing programme