[non-validated] Repository-Allocated DORA SFS B / SF 6 (Verified Remediation Evidence)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented verified closure status for all identified test findings within contractual timelines during the review period, as required by the repository's DORA allocation?
Explanation
[non-validated] For designated digital service providers under the repository's DORA allocation, this requirement assesses whether the entity has maintained a risk-based testing program, documented a findings register, and provided evidence of verified remediation for all identified test issues within contractual timelines during the review period, as referenced in repository documentation (DORA Article 24).
Criterion and evidence
Applies to designated digital service providers per repository allocation. Scope covers basic operational resilience testing program as described in topic documentation; excludes advanced TLPT regime addressed in SFS C. Evidence must reference the repository-defined review period. Positive determination requires documented findings register showing verified remediation for all test issues within contractual timelines. No alternatives satisfy repository-specified requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented findings register showing verified remediation for all identified test issues within specified contractual timelines during the review period as defined in repository documentation. Must include evidence of completion verification per keyDescription ('verified remediation').
Are alternative evidence forms acceptable?
No alternatives satisfy repository-specified requirements; documented verification of remediation is mandatory per topic allocation keyDescription ('verified remediation').
How are outstanding remediation items treated?
Findings register showing open remediation items exceeding contractual closure deadlines results in negative determination. Missing verification evidence for remediation status renders assessment pending per missingEvidence rule.
References
DORA: Digital operational resilience testing programme