DORA-Art13-P1 — DORA Knowledge Catalog

As part of the ICT risk management framework, financial entities shall adopt backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data.

Evidence Profiles

ICT Backup and Restoration Policy COMMON

Policy document defining backup strategies, retention periods, restoration procedures, and testing requirements for ICT systems as required by DORA Article 13.

Formats: DOCX
Evidence Class: backup-policy
Availability: COMMON
Update Frequency: annual
Typical Author: IT Operations Manager
Approval Chain: IT Operations Manager → CIO

Content Sections

Expected Fields

Common Quality Issues

Backup policy does not cover all critical systems
Restoration procedures never tested end-to-end
Retention periods not aligned with regulatory requirements
No offline or immutable backup provisions against ransomware

Fact Schemas

backup_policy_status

Schema ID: fs-backup-policy-status
Control: DORA-Art13-P1

Valid Ranges

effective_date: within last 18 months
retention_period_days: minimum 90 days for regulatory compliance
last_restoration_test_date: within last 12 months

Related Schemas

JSON Schema

{
  "properties": {
    "backup_frequency": {
      "enum": [
        "hourly",
        "daily",
        "weekly"
      ],
      "type": "string"
    },
    "covers_all_critical_systems": {
      "type": "boolean"
    },
    "effective_date": {
      "format": "date",
      "type": "string"
    },
    "has_immutable_backups": {
      "type": "boolean"
    },
    "last_restoration_test_date": {
      "format": "date",
      "type": "string"
    },
    "policy_version": {
      "type": "string"
    },
    "restoration_rto_hours": {
      "minimum": 0,
      "type": "number"
    },
    "restoration_test_successful": {
      "type": "boolean"
    },
    "retention_period_days": {
      "minimum": 1,
      "type": "integer"
    }
  },
  "required": [
    "policy_version",
    "effective_date",
    "backup_frequency",
    "retention_period_days",
    "last_restoration_test_date"
  ],
  "type": "object"
}