[non-validated] DORA SFS B / SF 7: Repository-Aligned Findings Register Documentation Verification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Does the findings register contain documented evidence of severity classification, responsible party assignment, and remediation timelines for each identified test finding during the review period?
Explanation
[non-validated] Does the findings register contain documented evidence of severity classification, responsible party assignment, and remediation timelines for each test finding during the review period, as specified in repository documentation under DORA-aligned topic boundaries for designated digital service providers?
Criterion and evidence
Assess designated entities per repository DORA allocation (SFS B). Scope: Basic operational resilience testing program per repository-defined boundaries; excludes advanced TLPT regime. Evidence period: Current review period as defined in repository documentation. Pass: Documented findings register demonstrating severity classification (e.g., Critical/High/Medium/Low), assigned responsible parties, and defined remediation timelines for all test findings per repository requirements. Fail: Missing any required element for one or more findings. Repository-sourced evidence only; no legal verification claimed.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence per repository requirements?
Documented findings register showing severity classifications (e.g., Critical/High/Medium/Low), assigned remediation owners with management oversight, and resolution timelines based on severity per repository topic boundaries. Evidence must cover all findings during the review period as defined in repository documentation. Missing elements result in failure status.
References
DORA: Digital operational resilience testing programme