[non-validated] DORA SFS F / SF A: Operational resilience testing for critical functions
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider implemented and tested operational resilience for critical functions through documented exercises as required by DORA Articles 40-41?
Explanation
[non-validated] Has the designated critical ICT provider (not a financial entity or ordinary ICT provider) implemented and tested operational resilience for critical functions through documented exercises as required by DORA Articles 40-41? Evidence must include dated test plans, execution reports, and management sign-off within the current validity period. Missing evidence remains pending; no alternatives satisfy this requirement.
Criterion and evidence
Entity role: designated critical ICT provider (DORA Article 3). Condition: Documented completion of operational resilience testing exercises covering critical functions per Articles 40-41. Evidence period: Current validity period under DORA implementation. Decision rule: Positive only with dated execution reports showing successful recovery; missing evidence = pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for operational resilience testing?
Valid evidence requires dated test plans, execution reports demonstrating successful recovery of critical functions, and management approval within the evidence period. Test schedules alone are insufficient. No alternatives satisfy Articles 40-41 requirements.
References
DORA: Critical provider oversight and supervisory readiness