[non-validated] DORA SFS B / SF C: Remediation Timeliness Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented verified evidence that all identified operational resilience test findings were remediated within their specified contractual timelines during the review period?
Explanation
[non-validated] Verifies that designated digital service providers maintain documented evidence showing all operational resilience test findings were remediated within specified contractual timelines during the review period, as outlined in repository topic documentation. Note: This reflects unverified repository template content and does not establish legal mandates or current statutory verification.
Criterion and evidence
Applies to designated digital service providers under the basic DORA regime (excluding advanced TLPT covered in SFS C). Requires documented findings register demonstrating verified completion of remediation within contractual timelines during the defined evidence period. No valid alternatives satisfy repository-specified requirements. Note: Reflects unverified repository content; not current legal verification or statutory implementation evidence.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for verified remediation timeline adherence?
Documented findings register dated within the review period showing verified completion of all remediation actions within contractual timelines (per repository topic description), including responsible party sign-off and independent verification timestamps. Must explicitly reference closure dates relative to contractual deadlines. Note: Reflects unverified repository template content; not current legal verification or statutory implementation evidence.
References
DORA: Digital operational resilience testing programme (repository template)