Draft catalog: 16 sets and 256 questions. Browse the catalog →
UNIQ²MeHomeHomeMethodologyMethodologyCatalogCatalogMASKSMASKSAboutAboutContactContactRepositoryRepository
GitHub repository (opens in a new tab)
  • Catalog status
  • What is an SFS?
  • What is an SF?
  • Browse sets
    • SFS 0 — Applicability, proportionality and governance
      • [non-validated] DORA SFS 0 / SF 0: Simplified Framework Eligibility
      • [non-validated] DORA SFS 0 / SF 1 (placeholder)
      • [non-validated] DORA SFS 0 / SF 2: Management Body Accountability for ICT Risk Framework
      • [non-validated] DORA: Applicability, proportionality and governance | SF 3
      • [non-validated] DORA: Management Body Resource Allocation [SFS 0 / SF 4]
      • [non-validated] Group Structure Boundaries per Repository Guidelines
      • [non-validated] DORA: Critical ICT Third-Party Provider Designation
      • [non-validated] DORA SFS 0 / SF 7: Management Body Periodic Reviews (non-validated)
      • [non-validated] Management Body Framework Determination (DORA SFS 0/SF 8)
      • [non-validated] DORA: Repository-Defined Microenterprise Threshold Verification
      • [non-validated] DORA SFS 0 / SF A: Critical ICT Third-Party Risk Management Framework Compliance
      • [non-validated] DORA SFS 0 / SF B: Framework-Specific ICT Risk Management Implementation
      • [non-validated] DORA SFS 0 / SF C: Framework Designation Determination
      • [non-validated] DORA SFS 0 / SF D: Entity Scope Determination under Financial Sectors
      • [non-validated] DORA SFS 0 / SF E: Management Body's Joint Assessment for Framework Determination
      • [non-validated] DORA SFS 0 / SF F: Proportionality Verification
    • SFS 1 — ICT risk framework and assurance
      • [non-validated] DORA SFS 1 / SF 0: ICT Risk Framework and Assurance
      • [non-validated] SFS 1: ICT Risk Management Framework Elements (Repository Specification)
      • [non-validated] DORA SFS 1 / SF 2: ICT Risk Management Framework (Article 6)
      • [non-validated] DORA SFS 1 / SF 3: Independent Control/Assurance Functions Documentation
      • [non-validated] DORA SFS 1 / SF 4: ICT Risk Framework Audit Follow-up
      • [non-validated] DORA SFS 1 / SF 5: Documented ICT Risk Framework Review Procedures
      • [non-validated] DORA SFS 1 / SF 6: ICT Risk Tolerance Documentation
      • [non-validated] DORA SFS 1 / SF 7: ICT Risk Management Framework Strategy
      • [non-validated] DORA SFS 1 / SF 8: Board Approval of Digital Operational Resilience Strategy
      • [non-validated] DORA SFS 1 / SF 9: ICT Risk Framework Approval
      • [non-validated] DORA SFS 1 / SF A: Staff learning and information-sharing procedures
      • [non-validated] DORA SFS 1 / SF B: fields pending
      • [non-validated] DORA SFS 1 / SF C: ICT Systems Testing Policies
      • [non-validated] DORA: ICT Risk Management Framework and Assurance (SF D)
      • [non-validated] DORA SFS 1 / SF E: Strategy Review Documentation
      • [non-validated] DORA SFS 1 / SF F: ICT Risk Framework Coverage
    • SFS 2 — ICT assets, services and dependency mapping
      • [non-validated] DORA SFS 2 / SF 0: fields pending
      • [non-validated] DORA SFS 2 / SF 1: ICT Dependency Mapping for Critical Functions
      • [non-validated] DORA SFS 2: ICT Asset Ownership for Critical Business Functions
      • [non-validated] DORA SFS 2 / SF 3: ICT Third-Party Support End-Date Monitoring
      • [non-validated] DORA SFS 2 / SF 4: fields pending
      • [non-validated] DORA SFS 2: ICT Asset Management for Critical Functions (SF 5)
      • [non-validated] DORA SFS 2 / SF 6: ICT Asset Adequacy Assessments (Non-Validated Draft)
      • [non-validated] DORA SFS 2 / SF 7: Legacy ICT Systems Risk Assessment Documentation
      • [non-validated] DORA SFS 2: Legacy ICT Systems Risk Management for Critical Operations
      • [non-validated] DORA SFS 2 / SF 9: Business-function classification for critical/important functions
      • [non-validated] DORA SFS 2: ICT Asset Management Policy Implementation
      • [non-validated] DORA SFS 2 / SF B (placeholder)
      • [non-validated] DORA SFS 2 / SF C: ICT Asset Ownership Accountability for Critical Functions
      • [non-validated] DORA SFS 2 / SF D: ICT Third-Party Regulatory Register (Repository Allocation)
      • [non-validated] DORA SFS 2 / SF E: ICT Asset Inventory for Critical Functions
      • [non-validated] DORA SFS 2 / SF F: ICT Dependency Maps for Critical Functions
    • SFS 3 — Protection, access and data security
      • [non-validated] DORA SFS 3 / SF 0: Protection, access and data security
      • [non-validated] DORA SFS 3 / SF 1: fields pending
      • [non-validated] DORA SFS 3 / SF 2: Access Management Controls per Articles 9 and 15
      • [non-validated] DORA SFS 3 / SF 3
      • [non-validated] DORA SFS 3 / SF 4: Protection, access and data security
      • [non-validated] DORA SFS 3 / SF 5: Physical and Environmental Security Safeguards
      • [non-validated] DORA SFS 3 / SF 6: Network Segregation Measures
      • [non-validated] DORA SFS 3 / SF 7: Framework Selection Evidence
      • [non-validated] DORA SFS 3 / SF 8: Proportionate access, data and network safeguards
      • [non-validated] DORA SFS 3 / SF 9 (placeholder)
      • [non-validated] DORA SFS 3 / SF A: Proportionality Determination for Security Safeguards
      • [non-validated] DORA SFS 3 / SF B: Cryptographic Safeguards
      • [non-validated] DORA SFS 3 / SF C: Data Integrity & Availability Protocols (Unverified Draft)
      • [non-validated] DORA SFS 3 / SF D: Access Permission Reviews
      • [non-validated] Least Privilege Access Controls (DORA SFS 3E)
      • [non-validated] DORA SFS 3 / SF F: Security Framework Application
    • SFS 4 — Secure change, development and vulnerability management
      • [non-validated] DORA SFS 4 / SF 0 (placeholder)
      • [non-validated] DORA SFS 4 / SF 1 (placeholder)
      • [non-validated] DORA SFS 4 / SF 2 (placeholder)
      • [non-validated] DORA SFS 4 / SF 3: Secure Change, Development and Vulnerability Management (Repository Allocation)
      • [non-validated] DORA SFS 4 / SF 4: Emergency Change Procedures
      • [non-validated] DORA SFS 4 / SF 5: Vulnerability Treatment Procedures Compliance
      • [non-validated] DORA SFS 4 / SF 6: Patching Procedures Compliance
      • [non-validated] DORA SFS 4 / SF 7: Supported-System Lifecycle Management
      • [non-validated] DORA SFS 4 / SF 8 (ICT System Lifecycle Management)
      • [non-validated] DORA SFS 4 / SF 9: Authorization workflows for ICT change
      • [non-validated] DORA SFS 4 / SF A: Acquisition and Development Controls [REPO ALLOCATION]
      • [non-validated] DORA SFS 4 / SF B: Pre-deployment Security Testing Procedures
      • [non-validated] DORA SFS 4 / SF C: Implementation per Repository Topic Description
      • [non-validated] DORA SFS 4 / SF D: Emergency Change Procedures Requirement
      • [non-validated] DORA SFS 4 / SF E (placeholder)
      • [non-validated] DORA SFS 4 / SF F: ICT-Risk Technical Standards Implementation (No Generic Maturity Substitution)
    • SFS 5 — Monitoring and anomalous activity detection
      • [non-validated] DORA Topic 5 / SF 0: Monitoring and Anomalous Activity Detection
      • [non-validated] DORA SFS 5 / SF 1: Detection Thresholds Configuration
      • [non-validated] DORA SFS 5 / SF 2: Entity-Executed Detection Capability Testing
      • [non-validated] DORA SFS 5 / SF 3: Monitoring Responsibilities and Escalation Triggers (Article 10)
      • [non-validated] DORA SFS 5 / SF 4 (Monitoring and anomalous activity detection)
      • [non-validated] DORA SFS 5 / SF 5: Alert Generation for Detected Incidents
      • [non-validated] DORA SFS 5: Detection Threshold Periodic Review (SF 6)
      • [non-validated] DORA SFS 5 / SF 7: External Incident Reporting Procedures
      • [non-validated] DORA SFS 5 / SF 8: Comprehensive Monitoring Coverage
      • [non-validated] DORA SFS 5 / SF 9: Performance Degradation Detection Evidence
      • [non-validated] DORA SFS 5 / SF A: Monitoring Handoff to Classification Team
      • [non-validated] DORA SFS 5 / SF B: Repository-Defined Severity Thresholds for Incident Handoff
      • [non-validated] DORA SFS 5 / SF C: Continuous monitoring operations
      • [non-validated] DORA SFS 5 / SF D: Periodic Review of Escalation Triggers
      • [non-validated] DORA SFS 5 / SF E: Detection Capability Testing Validation
      • [non-validated] DORA SFS 5 / SF F: Detection capability testing across mandated incident types
    • SFS 6 — Incident management and classification
      • [non-validated] DORA SFS 6 / SF 0 (placeholder)
      • [non-validated] DORA SFS 6 / SF 1: Incident management and classification
      • [non-validated] DORA SFS 6 / SF 2 (Incident classification)
      • [non-validated] DORA SFS 6 / SF 3 (placeholder)
      • [non-validated] DORA SFS 6 / SF 4: Incident Classification Criteria
      • [non-validated] DORA SFS 6 / SF 5: fields pending
      • [non-validated] DORA SFS 6 / SF 6: Root Cause Analysis for Major ICT Incidents
      • [non-validated] DORA SFS 6 / SF 7: Impact Determination Procedures under Articles 17-18
      • [non-validated] DORA SFS 6 / SF 8: ICT Incident Handling Mechanisms
      • [non-validated] DORA SFS 6: ICT Incident Classification Procedures
      • [non-validated] DORA: Comprehensive ICT Incident Classification
      • [non-validated] DORA SFS 6 / SF B: fields pending
      • [non-validated] DORA SFS 6 / SF C
      • [non-validated] DORA SFS 6 / SF D: Incident ownership accountability (unverified draft)
      • [non-validated] DORA: Incident Management and Classification - SF E (Incident Detection & Recording)
      • [non-validated] DORA SF F: Incident Management Framework
    • SFS 7 — Incident reporting and communications
      • [non-validated] SFS 7 / SF 0: Incident notification using current templates
      • [non-validated] DORA: Incident reporting and communications - SFS 7 / SF 1
      • [non-validated] DORA SFS 7 / SF 2: Final Incident Reporting
      • [non-validated] DORA SFS 7 / SF 3: Voluntary notification of significant cyber threats
      • [non-validated] DORA SFS 7 / SF 4: Voluntary Cyber Threat Notification Procedures
      • [non-validated] DORA SFS 7 / SF 5: Maintained Accountability in Delegated Incident Reporting
      • [non-validated] DORA SFS 7 / SF 6: Client and Stakeholder Communication Procedures
      • [non-validated] DORA SFS 7 / Crisis Communication Protocols
      • [non-validated] DORA SFS 7 / SF 8: Competent Authority Determination for Incident Reporting
      • [non-validated] DORA SFS 7 / SF 9: Payment-Related Incident Reporting Scope
      • [non-validated] Documented Incident Classification Procedures (DORA SFS 7 / SF A)
      • [non-validated] DORA SFS 7 / SF B: Incident classification under repository topic allocation
      • [non-validated] DORA SFS 7 / SF C: Internal Incident Response Communication Protocols
      • [non-validated] DORA SFS 7 / SF D: Entity classification verification
      • [non-validated] DORA SFS 7 / SF E: Monitoring Incident Reporting Procedures
      • [non-validated] DORA SFS 7 / SF F: Verification of Current Incident Reporting Templates (Repository Draft)
    • SFS 8 — ICT business continuity and crisis response
      • [non-validated] DORA SFS 8 / SF 0: ICT Business Continuity and Crisis Response
      • [non-validated] DORA SFS 8 / SF 1: Activation Protocols for Crisis Management
      • [non-validated] DORA SFS 8 / SF 2: Continuity Policy for Critical ICT Functions
      • [non-validated] DORA SFS 8 / SF 3: Continuity Policy for Critical ICT Functions (Excluding Backup)
      • [non-validated] DORA SFS 8 / SF 4: Third-Party Dependency Continuity Arrangements
      • [non-validated] DORA SFS 8 / SF 5: Crisis Management Procedures for Critical ICT Functions
      • [non-validated] DORA SFS 8 / SF 6: Critical ICT Function Dependency Documentation
      • [non-validated] DORA SFS 8 / SF 7: Business Impact Analysis
      • [non-validated] DORA Article 11: Continuity Exercise Documentation for Critical ICT Functions
      • [non-validated] DORA SFS 8 / SF 9: Backup and Restoration Verification
      • [non-validated] DORA SFS 8 / SF A: ICT Continuity Policy Documentation
      • [non-validated] DORA SFS 8 / SF B (placeholder)
      • [non-validated] DORA SFS 8 / SF C: Continuity exercises for critical ICT functions
      • [non-validated] DORA SFS 8 / SF D: Internal Communication Coordination Protocols
      • [non-validated] DORA SFS 8 / SF E: Response and Recovery Plans
      • [non-validated] DORA SFS 8: ICT Business Continuity and Crisis Response (Activation Protocols) [repo-only]
    • SFS 9 — Backup, restoration and recovery
      • [non-validated] DORA SFS 9 / SF 0: Restoration Testing Verification
      • [non-validated] Repository DORA SFS 9 / SF 1: Backup Storage Segregation (Placeholder)
      • [non-validated] DORA: Backup, restoration and recovery - SFS 9 / SF 2: Documented Recovery Objectives
      • [non-validated] DORA SFS 9 / SF 3: Data reconciliation process verification
      • [non-validated] DORA SFS 9 / SF 4: Restoration Testing Documentation
      • [non-validated] DORA SFS 9 / SF 5: Redundant capacity during recovery
      • [non-validated] DORA SFS 9 / SF 6: Backup Storage Segregation
      • [non-validated] DORA SFS 9 / SF 7: Documented RTO and RPO Specifications
      • [non-validated] DORA SFS 9 / SF 8: Redundant Capacity for Backup Availability
      • [non-validated] DORA SFS 9 / SF 9: Data Reconciliation Process
      • [non-validated] DORA SFS 9 / SF A: Backup Scope Documentation
      • [non-validated] DORA SFS 9 / SF B: Backup protection technical controls
      • [non-validated] DORA SFS 9 / SF C: Recovery Priorities
      • [non-validated] DORA SFS 9 / SF D: Protect Backup Copies
      • [non-validated] DORA SFS 9 / SF E (unverified draft)
      • [non-validated] DORA SFS 9 / SF F: Backup Scope Verification
    • SFS A — Learning, staff readiness and information sharing
      • [non-validated] DORA SFS A / SF 0: Learning, staff readiness and information sharing
      • [non-validated] DORA SFS A / SF 1: Security awareness training implementation [draft]
      • [non-validated] DORA SFS A / SF 2: Threat Intelligence Sharing Arrangements
      • [non-validated] DORA SFS A / SF 3: Incident Notification Procedures
      • [non-validated] DORA SFS A / SF 4: Provider Participation Determination Documentation
      • [non-validated] DORA SFS A / SF 5: Management Security Awareness Training
      • [non-validated] DORA SFS A / SF 6: Incorporation of incident/test lessons into security awareness training
      • [non-validated] DORA SFS A / SF 7: Incident Notification Procedures with Timelines and Content Specifications
      • [non-validated] DORA SFS A / SF 8: Relevant Provider Participation
      • [non-validated] DORA: Incident/Test Lessons Analysis for Resilience Improvements
      • [non-validated] DORA SFS A / SF A: Threat Intelligence Sharing Determination
      • [non-validated] DORA SFS A / SF B: Provider Participation Determination
      • [non-validated] DORA Area A, SF C: Currency of Security Awareness Training Content
      • [non-validated] DORA Area A, SF D: Documented Incident Review Procedures for Lessons Learned
      • [non-validated] DORA SFS A / SF E: Documented selection criteria for information sharing provider selection
      • [non-validated] DORA SFS A / SF F: Evidence of Resilience Improvements from Implemented Measures
    • SFS B — Digital operational resilience testing programme
      • [non-validated] DORA SFS B / SF 0: Operational Resilience Testing Programme
      • [non-validated] DORA Article 24: Findings Register Closure Verification
      • [non-validated] DORA SFS B / SF 2: Operational Resilience Testing Scope Coverage
      • [non-validated] DORA SFS B / SF 3: Test Type Specifications for Critical Systems
      • [non-validated] DORA SFS B / SF 4: Operational Resilience Testing Program - Post-Remediation Validation
      • [non-validated] DORA SFS B / SF 5 - Organizational Separation in Test Teams
      • [non-validated] Repository-Allocated DORA SFS B / SF 6 (Verified Remediation Evidence)
      • [non-validated] DORA SFS B / SF 7: Repository-Aligned Findings Register Documentation Verification
      • [non-validated] DORA SFS B / SF 8: Documented Risk-Based Test Planning Methodology
      • [non-validated] DORA SFS B / SF 9: Documented Test Team Separation
      • [non-validated] DORA SFS B / SF A: Verified Remediation Evidence
      • [non-validated] DORA: Operational Resilience Testing Coverage (Article 24) - Repository Draft
      • [non-validated] DORA SFS B / SF C: Remediation Timeliness Documentation
      • [non-validated] DORA SFS B / SF D (placeholder)
      • [non-validated] DORA SFS B / SF E: Senior Management Communication (Repository Topic Documentation)
      • [non-validated] DORA SFS B / SF F: Operational resilience testing frequency (repository-defined)
    • SFS C — Threat-led penetration testing
      • [non-validated] DORA SFS C / SF 0 (placeholder)
      • [non-validated] DORA Compliance: Threat-led Penetration Testing (SFS C/SF 1)
      • [non-validated] DORA SFS C / SF 2: Threat-led penetration testing - tester independence
      • [non-validated] DORA SFS C / SF 3: Threat intelligence in threat-led penetration testing
      • [non-validated] DORA SFS C / SF 4: Tester Independence and Qualification
      • [non-validated] DORA SFS C / SF 5 (placeholder)
      • [non-validated] DORA SFS C / SF 6: Live-System Safeguards in Threat-Led Penetration Testing
      • [non-validated] DORA SFS C / SF 7 (repository-sourced template; no legal verification)
      • [non-validated] DORA SFS C / SF 8: Mutual Recognition of TLPT Results under Article 27
      • [non-validated] DORA Threat-led Penetration Testing: Vulnerability Remediation Documentation (SF C9)
      • [non-validated] DORA Threat-led Penetration Testing: Third-Party Participation Requirement (SF A)
      • [non-validated] DORA SFS C / SF B: Competent authority selection for threat-led penetration testing
      • [non-validated] DORA SFS C / SF C: Critical ICT Function Identification
      • [non-validated] DORA SFS C / SF D (Critical function scope coverage)
      • [non-validated] DORA SFS C / SF E: Critical functions coverage in threat-led penetration testing
      • [non-validated] DORA SFS C / SF F: TLPT Scope Documentation Requirement
    • SFS D — ICT third-party risk, concentration and register
      • [non-validated] DORA SFS D / SF 0: ICT Third-Party Risk Management
      • [non-validated] DORA SFS D / SF 1: ICT Third-Party Risk Register with Criticality Designations
      • [non-validated] DORA SFS D / SF 2: Concentration Risk Management
      • [non-validated] DORA SFS D / SF 3: Pre-contract assessment for critical ICT providers
      • [non-validated] DORA SFS D / SF 4: Accountable Ownership for ICT Third-Party Risk Management
      • [non-validated] DORA SFS D / SF 5: Conflicts of Interest Management
      • [non-validated] DORA SFS D / SF 6: Conflicts of interest management for ICT third-party arrangements
      • [non-validated] DORA SFS D / SF 7: ICT Third-Party Risk Register Submission
      • [non-validated] DORA SFS D / SF 8 (placeholder)
      • [non-validated] DORA SFS D / SF 9: Pre-contract ICT Third-Party Critical Service Assessment
      • [non-validated] DORA SFS D / SF A: Third-Party Strategy Accountability Oversight
      • [non-validated] DORA: Documentation of subcontracting arrangements in ICT third-party risk register (Article 28)
      • [non-validated] DORA SFS D / SF C: Group-level ICT Third-Party Risk Register
      • [non-validated] DORA: ICT Third-Party Due Diligence Register Documentation
      • [non-validated] DORA SFS D / SF E: Contractual Clauses for ICT Third-Party Subcontracting and Exits
      • [non-validated] DORA SFS D / SF F: Designated Critical ICT Third-Party Provider Oversight
    • SFS E — Provider contracts, subcontracting and exit
      • [non-validated] DORA SFS E / SF 0 (Provider contracts, subcontracting and exit)
      • [non-validated] DORA Area E: Provider Contracts, Subcontracting and Exit Strategies - Condition 1
      • [non-validated] DORA SFS E / SF 2: Incident assistance in ICT contracts
      • [non-validated] DORA: Provider contracts, subcontracting and exit / SF 3
      • [non-validated] DORA SFS E / SF 4: Documented subcontractor change management procedures
      • [non-validated] Termination Rights with Data Recovery for Critical Functions
      • [non-validated] DORA SFS E / SF 6: Data Storage Location Specifications
      • [non-validated] DORA SFS E / SF 7: Prior Approval for Critical Function Subcontracting
      • [non-validated] DORA SFS E / SF 8: Contractual differentiation for critical ICT functions
      • [non-validated] DORA SFS E / SF 9: Contractual Rights and Obligations
      • [non-validated] DORA SFS E / SF A: Contractual Enforceability for Critical Functions
      • [non-validated] DORA SFS E / SF B: Critical Function Subcontractor Oversight
      • [non-validated] DORA SFS E / SF C: Subcontractor Incident Assistance Obligations
      • [non-validated] DORA SFS E / SF D: Termination rights and exit strategies (baseline)
      • [non-validated] DORA SFS E / SF E: Subcontracting oversight in ICT contracts
      • [non-validated] DORA SFS E / SF F: Non-critical ICT function contractual baselines
    • SFS F — Critical provider oversight and supervisory readiness
      • [non-validated] DORA SFS F / SF 0: Critical Provider Inspection Access and Remediation Reporting
      • [non-validated] DORA: Critical provider oversight and supervisory readiness
      • [non-validated] DORA SFS F / SF 2: Critical provider oversight and supervisory readiness
      • [non-validated] DORA SFS F / SF 3: Repository placeholder (pending legal verification)
      • [non-validated] DORA SFS F / SF 4: Third-party ICT service provider oversight
      • [non-validated] DORA SFS F / SF 5: Supervisory Findings and Corrective Actions Documentation
      • [non-validated] DORA SFS F / SF 6: Operational resilience testing by designated critical ICT providers (Article 37)
      • [non-validated] DORA SFS F / SF 7: Critical Provider Oversight Requirements
      • [non-validated] DORA SFS F / SF 8: Supervisory Communication Records Maintenance (repository-sourced draft)
      • [non-validated] DORA SFS F / SF 9: Critical provider notification duty (Article 33)
      • [non-validated] DORA SFS F / SF A: Operational resilience testing for critical functions
      • [non-validated] DORA SFS F / SF B: Supervisory Liaison Officer Appointment
      • [non-validated] DORA: Critical provider oversight and supervisory readiness
      • [non-validated] Critical ICT Provider Incident Reporting Obligations Under DORA Article 37(1)-(2)
      • [non-validated] DORA SFS F / SF E: Incident severity categorization under Article 36
      • [non-validated] [field-updates-reviewed] DORA SFS F / SF F: completed refinements (unverified draft)
  • Requirement masks
    • Requirement masks
  • Live progress
  • Home
  • Methodology
    • Methodology overview
    • Introduction
    • Terms and notation
    • Evidence and interpretation
    • Question records
    • Assessment and validation
    • Assessment encoding
    • Requirement masks
    • Catalog versions
    • Worked examples
    • AI-assisted assessment
    • Frequently asked questions
    • Resources and related work
  • Catalog
    • Catalog status
    • What is an SFS?
    • What is an SF?
    • Browse sets
      • SFS 0 — Applicability, proportionality and governance
        • [non-validated] DORA SFS 0 / SF 0: Simplified Framework Eligibility
        • [non-validated] DORA SFS 0 / SF 1 (placeholder)
        • [non-validated] DORA SFS 0 / SF 2: Management Body Accountability for ICT Risk Framework
        • [non-validated] DORA: Applicability, proportionality and governance | SF 3
        • [non-validated] DORA: Management Body Resource Allocation [SFS 0 / SF 4]
        • [non-validated] Group Structure Boundaries per Repository Guidelines
        • [non-validated] DORA: Critical ICT Third-Party Provider Designation
        • [non-validated] DORA SFS 0 / SF 7: Management Body Periodic Reviews (non-validated)
        • [non-validated] Management Body Framework Determination (DORA SFS 0/SF 8)
        • [non-validated] DORA: Repository-Defined Microenterprise Threshold Verification
        • [non-validated] DORA SFS 0 / SF A: Critical ICT Third-Party Risk Management Framework Compliance
        • [non-validated] DORA SFS 0 / SF B: Framework-Specific ICT Risk Management Implementation
        • [non-validated] DORA SFS 0 / SF C: Framework Designation Determination
        • [non-validated] DORA SFS 0 / SF D: Entity Scope Determination under Financial Sectors
        • [non-validated] DORA SFS 0 / SF E: Management Body's Joint Assessment for Framework Determination
        • [non-validated] DORA SFS 0 / SF F: Proportionality Verification
      • SFS 1 — ICT risk framework and assurance
        • [non-validated] DORA SFS 1 / SF 0: ICT Risk Framework and Assurance
        • [non-validated] SFS 1: ICT Risk Management Framework Elements (Repository Specification)
        • [non-validated] DORA SFS 1 / SF 2: ICT Risk Management Framework (Article 6)
        • [non-validated] DORA SFS 1 / SF 3: Independent Control/Assurance Functions Documentation
        • [non-validated] DORA SFS 1 / SF 4: ICT Risk Framework Audit Follow-up
        • [non-validated] DORA SFS 1 / SF 5: Documented ICT Risk Framework Review Procedures
        • [non-validated] DORA SFS 1 / SF 6: ICT Risk Tolerance Documentation
        • [non-validated] DORA SFS 1 / SF 7: ICT Risk Management Framework Strategy
        • [non-validated] DORA SFS 1 / SF 8: Board Approval of Digital Operational Resilience Strategy
        • [non-validated] DORA SFS 1 / SF 9: ICT Risk Framework Approval
        • [non-validated] DORA SFS 1 / SF A: Staff learning and information-sharing procedures
        • [non-validated] DORA SFS 1 / SF B: fields pending
        • [non-validated] DORA SFS 1 / SF C: ICT Systems Testing Policies
        • [non-validated] DORA: ICT Risk Management Framework and Assurance (SF D)
        • [non-validated] DORA SFS 1 / SF E: Strategy Review Documentation
        • [non-validated] DORA SFS 1 / SF F: ICT Risk Framework Coverage
      • SFS 2 — ICT assets, services and dependency mapping
        • [non-validated] DORA SFS 2 / SF 0: fields pending
        • [non-validated] DORA SFS 2 / SF 1: ICT Dependency Mapping for Critical Functions
        • [non-validated] DORA SFS 2: ICT Asset Ownership for Critical Business Functions
        • [non-validated] DORA SFS 2 / SF 3: ICT Third-Party Support End-Date Monitoring
        • [non-validated] DORA SFS 2 / SF 4: fields pending
        • [non-validated] DORA SFS 2: ICT Asset Management for Critical Functions (SF 5)
        • [non-validated] DORA SFS 2 / SF 6: ICT Asset Adequacy Assessments (Non-Validated Draft)
        • [non-validated] DORA SFS 2 / SF 7: Legacy ICT Systems Risk Assessment Documentation
        • [non-validated] DORA SFS 2: Legacy ICT Systems Risk Management for Critical Operations
        • [non-validated] DORA SFS 2 / SF 9: Business-function classification for critical/important functions
        • [non-validated] DORA SFS 2: ICT Asset Management Policy Implementation
        • [non-validated] DORA SFS 2 / SF B (placeholder)
        • [non-validated] DORA SFS 2 / SF C: ICT Asset Ownership Accountability for Critical Functions
        • [non-validated] DORA SFS 2 / SF D: ICT Third-Party Regulatory Register (Repository Allocation)
        • [non-validated] DORA SFS 2 / SF E: ICT Asset Inventory for Critical Functions
        • [non-validated] DORA SFS 2 / SF F: ICT Dependency Maps for Critical Functions
      • SFS 3 — Protection, access and data security
        • [non-validated] DORA SFS 3 / SF 0: Protection, access and data security
        • [non-validated] DORA SFS 3 / SF 1: fields pending
        • [non-validated] DORA SFS 3 / SF 2: Access Management Controls per Articles 9 and 15
        • [non-validated] DORA SFS 3 / SF 3
        • [non-validated] DORA SFS 3 / SF 4: Protection, access and data security
        • [non-validated] DORA SFS 3 / SF 5: Physical and Environmental Security Safeguards
        • [non-validated] DORA SFS 3 / SF 6: Network Segregation Measures
        • [non-validated] DORA SFS 3 / SF 7: Framework Selection Evidence
        • [non-validated] DORA SFS 3 / SF 8: Proportionate access, data and network safeguards
        • [non-validated] DORA SFS 3 / SF 9 (placeholder)
        • [non-validated] DORA SFS 3 / SF A: Proportionality Determination for Security Safeguards
        • [non-validated] DORA SFS 3 / SF B: Cryptographic Safeguards
        • [non-validated] DORA SFS 3 / SF C: Data Integrity & Availability Protocols (Unverified Draft)
        • [non-validated] DORA SFS 3 / SF D: Access Permission Reviews
        • [non-validated] Least Privilege Access Controls (DORA SFS 3E)
        • [non-validated] DORA SFS 3 / SF F: Security Framework Application
      • SFS 4 — Secure change, development and vulnerability management
        • [non-validated] DORA SFS 4 / SF 0 (placeholder)
        • [non-validated] DORA SFS 4 / SF 1 (placeholder)
        • [non-validated] DORA SFS 4 / SF 2 (placeholder)
        • [non-validated] DORA SFS 4 / SF 3: Secure Change, Development and Vulnerability Management (Repository Allocation)
        • [non-validated] DORA SFS 4 / SF 4: Emergency Change Procedures
        • [non-validated] DORA SFS 4 / SF 5: Vulnerability Treatment Procedures Compliance
        • [non-validated] DORA SFS 4 / SF 6: Patching Procedures Compliance
        • [non-validated] DORA SFS 4 / SF 7: Supported-System Lifecycle Management
        • [non-validated] DORA SFS 4 / SF 8 (ICT System Lifecycle Management)
        • [non-validated] DORA SFS 4 / SF 9: Authorization workflows for ICT change
        • [non-validated] DORA SFS 4 / SF A: Acquisition and Development Controls [REPO ALLOCATION]
        • [non-validated] DORA SFS 4 / SF B: Pre-deployment Security Testing Procedures
        • [non-validated] DORA SFS 4 / SF C: Implementation per Repository Topic Description
        • [non-validated] DORA SFS 4 / SF D: Emergency Change Procedures Requirement
        • [non-validated] DORA SFS 4 / SF E (placeholder)
        • [non-validated] DORA SFS 4 / SF F: ICT-Risk Technical Standards Implementation (No Generic Maturity Substitution)
      • SFS 5 — Monitoring and anomalous activity detection
        • [non-validated] DORA Topic 5 / SF 0: Monitoring and Anomalous Activity Detection
        • [non-validated] DORA SFS 5 / SF 1: Detection Thresholds Configuration
        • [non-validated] DORA SFS 5 / SF 2: Entity-Executed Detection Capability Testing
        • [non-validated] DORA SFS 5 / SF 3: Monitoring Responsibilities and Escalation Triggers (Article 10)
        • [non-validated] DORA SFS 5 / SF 4 (Monitoring and anomalous activity detection)
        • [non-validated] DORA SFS 5 / SF 5: Alert Generation for Detected Incidents
        • [non-validated] DORA SFS 5: Detection Threshold Periodic Review (SF 6)
        • [non-validated] DORA SFS 5 / SF 7: External Incident Reporting Procedures
        • [non-validated] DORA SFS 5 / SF 8: Comprehensive Monitoring Coverage
        • [non-validated] DORA SFS 5 / SF 9: Performance Degradation Detection Evidence
        • [non-validated] DORA SFS 5 / SF A: Monitoring Handoff to Classification Team
        • [non-validated] DORA SFS 5 / SF B: Repository-Defined Severity Thresholds for Incident Handoff
        • [non-validated] DORA SFS 5 / SF C: Continuous monitoring operations
        • [non-validated] DORA SFS 5 / SF D: Periodic Review of Escalation Triggers
        • [non-validated] DORA SFS 5 / SF E: Detection Capability Testing Validation
        • [non-validated] DORA SFS 5 / SF F: Detection capability testing across mandated incident types
      • SFS 6 — Incident management and classification
        • [non-validated] DORA SFS 6 / SF 0 (placeholder)
        • [non-validated] DORA SFS 6 / SF 1: Incident management and classification
        • [non-validated] DORA SFS 6 / SF 2 (Incident classification)
        • [non-validated] DORA SFS 6 / SF 3 (placeholder)
        • [non-validated] DORA SFS 6 / SF 4: Incident Classification Criteria
        • [non-validated] DORA SFS 6 / SF 5: fields pending
        • [non-validated] DORA SFS 6 / SF 6: Root Cause Analysis for Major ICT Incidents
        • [non-validated] DORA SFS 6 / SF 7: Impact Determination Procedures under Articles 17-18
        • [non-validated] DORA SFS 6 / SF 8: ICT Incident Handling Mechanisms
        • [non-validated] DORA SFS 6: ICT Incident Classification Procedures
        • [non-validated] DORA: Comprehensive ICT Incident Classification
        • [non-validated] DORA SFS 6 / SF B: fields pending
        • [non-validated] DORA SFS 6 / SF C
        • [non-validated] DORA SFS 6 / SF D: Incident ownership accountability (unverified draft)
        • [non-validated] DORA: Incident Management and Classification - SF E (Incident Detection & Recording)
        • [non-validated] DORA SF F: Incident Management Framework
      • SFS 7 — Incident reporting and communications
        • [non-validated] SFS 7 / SF 0: Incident notification using current templates
        • [non-validated] DORA: Incident reporting and communications - SFS 7 / SF 1
        • [non-validated] DORA SFS 7 / SF 2: Final Incident Reporting
        • [non-validated] DORA SFS 7 / SF 3: Voluntary notification of significant cyber threats
        • [non-validated] DORA SFS 7 / SF 4: Voluntary Cyber Threat Notification Procedures
        • [non-validated] DORA SFS 7 / SF 5: Maintained Accountability in Delegated Incident Reporting
        • [non-validated] DORA SFS 7 / SF 6: Client and Stakeholder Communication Procedures
        • [non-validated] DORA SFS 7 / Crisis Communication Protocols
        • [non-validated] DORA SFS 7 / SF 8: Competent Authority Determination for Incident Reporting
        • [non-validated] DORA SFS 7 / SF 9: Payment-Related Incident Reporting Scope
        • [non-validated] Documented Incident Classification Procedures (DORA SFS 7 / SF A)
        • [non-validated] DORA SFS 7 / SF B: Incident classification under repository topic allocation
        • [non-validated] DORA SFS 7 / SF C: Internal Incident Response Communication Protocols
        • [non-validated] DORA SFS 7 / SF D: Entity classification verification
        • [non-validated] DORA SFS 7 / SF E: Monitoring Incident Reporting Procedures
        • [non-validated] DORA SFS 7 / SF F: Verification of Current Incident Reporting Templates (Repository Draft)
      • SFS 8 — ICT business continuity and crisis response
        • [non-validated] DORA SFS 8 / SF 0: ICT Business Continuity and Crisis Response
        • [non-validated] DORA SFS 8 / SF 1: Activation Protocols for Crisis Management
        • [non-validated] DORA SFS 8 / SF 2: Continuity Policy for Critical ICT Functions
        • [non-validated] DORA SFS 8 / SF 3: Continuity Policy for Critical ICT Functions (Excluding Backup)
        • [non-validated] DORA SFS 8 / SF 4: Third-Party Dependency Continuity Arrangements
        • [non-validated] DORA SFS 8 / SF 5: Crisis Management Procedures for Critical ICT Functions
        • [non-validated] DORA SFS 8 / SF 6: Critical ICT Function Dependency Documentation
        • [non-validated] DORA SFS 8 / SF 7: Business Impact Analysis
        • [non-validated] DORA Article 11: Continuity Exercise Documentation for Critical ICT Functions
        • [non-validated] DORA SFS 8 / SF 9: Backup and Restoration Verification
        • [non-validated] DORA SFS 8 / SF A: ICT Continuity Policy Documentation
        • [non-validated] DORA SFS 8 / SF B (placeholder)
        • [non-validated] DORA SFS 8 / SF C: Continuity exercises for critical ICT functions
        • [non-validated] DORA SFS 8 / SF D: Internal Communication Coordination Protocols
        • [non-validated] DORA SFS 8 / SF E: Response and Recovery Plans
        • [non-validated] DORA SFS 8: ICT Business Continuity and Crisis Response (Activation Protocols) [repo-only]
      • SFS 9 — Backup, restoration and recovery
        • [non-validated] DORA SFS 9 / SF 0: Restoration Testing Verification
        • [non-validated] Repository DORA SFS 9 / SF 1: Backup Storage Segregation (Placeholder)
        • [non-validated] DORA: Backup, restoration and recovery - SFS 9 / SF 2: Documented Recovery Objectives
        • [non-validated] DORA SFS 9 / SF 3: Data reconciliation process verification
        • [non-validated] DORA SFS 9 / SF 4: Restoration Testing Documentation
        • [non-validated] DORA SFS 9 / SF 5: Redundant capacity during recovery
        • [non-validated] DORA SFS 9 / SF 6: Backup Storage Segregation
        • [non-validated] DORA SFS 9 / SF 7: Documented RTO and RPO Specifications
        • [non-validated] DORA SFS 9 / SF 8: Redundant Capacity for Backup Availability
        • [non-validated] DORA SFS 9 / SF 9: Data Reconciliation Process
        • [non-validated] DORA SFS 9 / SF A: Backup Scope Documentation
        • [non-validated] DORA SFS 9 / SF B: Backup protection technical controls
        • [non-validated] DORA SFS 9 / SF C: Recovery Priorities
        • [non-validated] DORA SFS 9 / SF D: Protect Backup Copies
        • [non-validated] DORA SFS 9 / SF E (unverified draft)
        • [non-validated] DORA SFS 9 / SF F: Backup Scope Verification
      • SFS A — Learning, staff readiness and information sharing
        • [non-validated] DORA SFS A / SF 0: Learning, staff readiness and information sharing
        • [non-validated] DORA SFS A / SF 1: Security awareness training implementation [draft]
        • [non-validated] DORA SFS A / SF 2: Threat Intelligence Sharing Arrangements
        • [non-validated] DORA SFS A / SF 3: Incident Notification Procedures
        • [non-validated] DORA SFS A / SF 4: Provider Participation Determination Documentation
        • [non-validated] DORA SFS A / SF 5: Management Security Awareness Training
        • [non-validated] DORA SFS A / SF 6: Incorporation of incident/test lessons into security awareness training
        • [non-validated] DORA SFS A / SF 7: Incident Notification Procedures with Timelines and Content Specifications
        • [non-validated] DORA SFS A / SF 8: Relevant Provider Participation
        • [non-validated] DORA: Incident/Test Lessons Analysis for Resilience Improvements
        • [non-validated] DORA SFS A / SF A: Threat Intelligence Sharing Determination
        • [non-validated] DORA SFS A / SF B: Provider Participation Determination
        • [non-validated] DORA Area A, SF C: Currency of Security Awareness Training Content
        • [non-validated] DORA Area A, SF D: Documented Incident Review Procedures for Lessons Learned
        • [non-validated] DORA SFS A / SF E: Documented selection criteria for information sharing provider selection
        • [non-validated] DORA SFS A / SF F: Evidence of Resilience Improvements from Implemented Measures
      • SFS B — Digital operational resilience testing programme
        • [non-validated] DORA SFS B / SF 0: Operational Resilience Testing Programme
        • [non-validated] DORA Article 24: Findings Register Closure Verification
        • [non-validated] DORA SFS B / SF 2: Operational Resilience Testing Scope Coverage
        • [non-validated] DORA SFS B / SF 3: Test Type Specifications for Critical Systems
        • [non-validated] DORA SFS B / SF 4: Operational Resilience Testing Program - Post-Remediation Validation
        • [non-validated] DORA SFS B / SF 5 - Organizational Separation in Test Teams
        • [non-validated] Repository-Allocated DORA SFS B / SF 6 (Verified Remediation Evidence)
        • [non-validated] DORA SFS B / SF 7: Repository-Aligned Findings Register Documentation Verification
        • [non-validated] DORA SFS B / SF 8: Documented Risk-Based Test Planning Methodology
        • [non-validated] DORA SFS B / SF 9: Documented Test Team Separation
        • [non-validated] DORA SFS B / SF A: Verified Remediation Evidence
        • [non-validated] DORA: Operational Resilience Testing Coverage (Article 24) - Repository Draft
        • [non-validated] DORA SFS B / SF C: Remediation Timeliness Documentation
        • [non-validated] DORA SFS B / SF D (placeholder)
        • [non-validated] DORA SFS B / SF E: Senior Management Communication (Repository Topic Documentation)
        • [non-validated] DORA SFS B / SF F: Operational resilience testing frequency (repository-defined)
      • SFS C — Threat-led penetration testing
        • [non-validated] DORA SFS C / SF 0 (placeholder)
        • [non-validated] DORA Compliance: Threat-led Penetration Testing (SFS C/SF 1)
        • [non-validated] DORA SFS C / SF 2: Threat-led penetration testing - tester independence
        • [non-validated] DORA SFS C / SF 3: Threat intelligence in threat-led penetration testing
        • [non-validated] DORA SFS C / SF 4: Tester Independence and Qualification
        • [non-validated] DORA SFS C / SF 5 (placeholder)
        • [non-validated] DORA SFS C / SF 6: Live-System Safeguards in Threat-Led Penetration Testing
        • [non-validated] DORA SFS C / SF 7 (repository-sourced template; no legal verification)
        • [non-validated] DORA SFS C / SF 8: Mutual Recognition of TLPT Results under Article 27
        • [non-validated] DORA Threat-led Penetration Testing: Vulnerability Remediation Documentation (SF C9)
        • [non-validated] DORA Threat-led Penetration Testing: Third-Party Participation Requirement (SF A)
        • [non-validated] DORA SFS C / SF B: Competent authority selection for threat-led penetration testing
        • [non-validated] DORA SFS C / SF C: Critical ICT Function Identification
        • [non-validated] DORA SFS C / SF D (Critical function scope coverage)
        • [non-validated] DORA SFS C / SF E: Critical functions coverage in threat-led penetration testing
        • [non-validated] DORA SFS C / SF F: TLPT Scope Documentation Requirement
      • SFS D — ICT third-party risk, concentration and register
        • [non-validated] DORA SFS D / SF 0: ICT Third-Party Risk Management
        • [non-validated] DORA SFS D / SF 1: ICT Third-Party Risk Register with Criticality Designations
        • [non-validated] DORA SFS D / SF 2: Concentration Risk Management
        • [non-validated] DORA SFS D / SF 3: Pre-contract assessment for critical ICT providers
        • [non-validated] DORA SFS D / SF 4: Accountable Ownership for ICT Third-Party Risk Management
        • [non-validated] DORA SFS D / SF 5: Conflicts of Interest Management
        • [non-validated] DORA SFS D / SF 6: Conflicts of interest management for ICT third-party arrangements
        • [non-validated] DORA SFS D / SF 7: ICT Third-Party Risk Register Submission
        • [non-validated] DORA SFS D / SF 8 (placeholder)
        • [non-validated] DORA SFS D / SF 9: Pre-contract ICT Third-Party Critical Service Assessment
        • [non-validated] DORA SFS D / SF A: Third-Party Strategy Accountability Oversight
        • [non-validated] DORA: Documentation of subcontracting arrangements in ICT third-party risk register (Article 28)
        • [non-validated] DORA SFS D / SF C: Group-level ICT Third-Party Risk Register
        • [non-validated] DORA: ICT Third-Party Due Diligence Register Documentation
        • [non-validated] DORA SFS D / SF E: Contractual Clauses for ICT Third-Party Subcontracting and Exits
        • [non-validated] DORA SFS D / SF F: Designated Critical ICT Third-Party Provider Oversight
      • SFS E — Provider contracts, subcontracting and exit
        • [non-validated] DORA SFS E / SF 0 (Provider contracts, subcontracting and exit)
        • [non-validated] DORA Area E: Provider Contracts, Subcontracting and Exit Strategies - Condition 1
        • [non-validated] DORA SFS E / SF 2: Incident assistance in ICT contracts
        • [non-validated] DORA: Provider contracts, subcontracting and exit / SF 3
        • [non-validated] DORA SFS E / SF 4: Documented subcontractor change management procedures
        • [non-validated] Termination Rights with Data Recovery for Critical Functions
        • [non-validated] DORA SFS E / SF 6: Data Storage Location Specifications
        • [non-validated] DORA SFS E / SF 7: Prior Approval for Critical Function Subcontracting
        • [non-validated] DORA SFS E / SF 8: Contractual differentiation for critical ICT functions
        • [non-validated] DORA SFS E / SF 9: Contractual Rights and Obligations
        • [non-validated] DORA SFS E / SF A: Contractual Enforceability for Critical Functions
        • [non-validated] DORA SFS E / SF B: Critical Function Subcontractor Oversight
        • [non-validated] DORA SFS E / SF C: Subcontractor Incident Assistance Obligations
        • [non-validated] DORA SFS E / SF D: Termination rights and exit strategies (baseline)
        • [non-validated] DORA SFS E / SF E: Subcontracting oversight in ICT contracts
        • [non-validated] DORA SFS E / SF F: Non-critical ICT function contractual baselines
      • SFS F — Critical provider oversight and supervisory readiness
        • [non-validated] DORA SFS F / SF 0: Critical Provider Inspection Access and Remediation Reporting
        • [non-validated] DORA: Critical provider oversight and supervisory readiness
        • [non-validated] DORA SFS F / SF 2: Critical provider oversight and supervisory readiness
        • [non-validated] DORA SFS F / SF 3: Repository placeholder (pending legal verification)
        • [non-validated] DORA SFS F / SF 4: Third-party ICT service provider oversight
        • [non-validated] DORA SFS F / SF 5: Supervisory Findings and Corrective Actions Documentation
        • [non-validated] DORA SFS F / SF 6: Operational resilience testing by designated critical ICT providers (Article 37)
        • [non-validated] DORA SFS F / SF 7: Critical Provider Oversight Requirements
        • [non-validated] DORA SFS F / SF 8: Supervisory Communication Records Maintenance (repository-sourced draft)
        • [non-validated] DORA SFS F / SF 9: Critical provider notification duty (Article 33)
        • [non-validated] DORA SFS F / SF A: Operational resilience testing for critical functions
        • [non-validated] DORA SFS F / SF B: Supervisory Liaison Officer Appointment
        • [non-validated] DORA: Critical provider oversight and supervisory readiness
        • [non-validated] Critical ICT Provider Incident Reporting Obligations Under DORA Article 37(1)-(2)
        • [non-validated] DORA SFS F / SF E: Incident severity categorization under Article 36
        • [non-validated] [field-updates-reviewed] DORA SFS F / SF F: completed refinements (unverified draft)
    • Requirement masks
      • Requirement masks
    • Live progress
  • MASKS
    • MASKS overview
    • Complete catalog masks
    • Scoring Factor Set masks
    • Individual SF masks
  • About
  • Contact
  • Repository
Suggest a correction → (opens in a new tab)Edit this page on GitHub →
Catalog
What is an SFS?

Scoring Factor Sets

Each SFS groups sixteen factors in one fixed area of interest. The sixteen sets are identified by 0–F. Browse the sets.

Catalog statusWhat is an SF?

2026 © UNIQ2Me — Methodology and draft question catalog