They should prioritise evidence as soon as the programme needs to prove control effectiveness, not just collect responses. DORA is about demonstrated resilience, so inventory records, access trails, control mappings, and audit artefacts carry more weight than repeated form-filling. Questionnaires still matter, but they are only useful when tied to verifiable operational records.
Evidence First, Questionnaire Second
When a financial team needs to show that a control is actually operating, not merely described, evidence should move ahead of another questionnaire. DORA is a resilience regime, so proof from inventory records, access trails, test results, and control mappings is more persuasive than another attestation cycle. A questionnaire still has value, but it should point to records that can be checked.
That shift matters because repeated forms often measure intent, while DORA scrutiny tends to focus on operational reality. If a team cannot produce artefacts that show who owns a control, when it was exercised, and what changed after testing, then the questionnaire is documenting a gap rather than closing it. Evidence turns claims into something an auditor or assurance reviewer can follow.
What Counts as Strong DORA Evidence
The right evidence depends on the control, but it usually comes from sources that were created during normal operations rather than assembled after the fact. Useful examples include asset and system inventories, privileged access logs, joiner-mover-leaver records, incident tickets, backup and recovery results, and third-party control mappings. Those artefacts show traceability, not just policy intent.
For DORA purposes, the most credible evidence is also the most time-bound. Current screenshots with no history are weaker than logs, approvals, recertifications, and test outputs that show the control over time. Teams should prefer evidence that demonstrates frequency, ownership, and exception handling, because resilience depends on whether the process is repeatable under stress. See the EU Digital Operational Resilience Act (DORA) for the regulatory context behind that expectation.
For teams mapping controls to broader governance records, the evidence set should also show how each control is tied back to a specific obligation, risk, or test outcome. NHIMG’s Identity Security Regulatory Map is useful for linking control evidence to regulatory requirements, while the Financial Services Identity Security Guide helps financial teams connect access evidence, third-party risk, and privileged controls into one audit-ready story.
When a Questionnaire Still Earns Its Place
Questionnaires are still useful when the team needs structured discovery, vendor comparison, or an initial gap scan before the evidence request becomes precise. They help identify missing owners, undocumented processes, and controls that exist only in policy form. In other words, questionnaires are good at narrowing the search, but not at proving resilience on their own.
The strongest use case is when a questionnaire is used to target the exact artefacts needed for validation. That means asking for record types, retention periods, control owners, test frequency, and exceptions, then following up with proof. NHIMG’s Ultimate Guide to NHIs, Regulatory and Audit Perspectives is a useful reference for the audit trail mindset, especially where service accounts, automation, or other non-human access paths need evidentiary support.
When questionnaires and evidence conflict, the artefact should win. If a vendor says a control exists but cannot show logs, approvals, or test results, the issue is not wording quality, it is control confidence. Teams should treat the questionnaire as a guide to evidence collection, not as evidence itself.
Risk and Threat Considerations
Relying on questionnaires alone creates a false sense of assurance, especially in programmes that must withstand supervisory review, vendor challenge, or incident investigation. The risk is not just incomplete documentation, it is overestimating control effectiveness where access, inventory, or recovery gaps may already exist.
Failure mechanism: Teams collect statements about a control instead of artefacts showing the control operated, so weak governance, stale access, or missing recovery proof remains hidden until audit or incident time.
Impact: The organisation may fail to demonstrate resilience, prolong remediation, and lose credibility with auditors, regulators, and third parties when evidence is requested.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while DORA and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| DORA | GV.RM-01 — Risk Management Strategy | DORA drives evidence-based operational resilience and control validation. |
| ID.AM-01 — Inventories of Assets | Inventory records are core proof for DORA control coverage and ownership. | |
| PR.AA-05 — Identity Management, Authentication and Access Control | Access trails and privileged records are key evidence for effective control operation. | |
| Recommendation — Use operating evidence to validate resilience controls, not questionnaire responses alone. Maintain current inventories that tie controls to the systems and processes they protect. Retain access logs and approvals that demonstrate who had access and when it changed. | ||
| ISO/IEC 27001:2022 | A.5.35 — Independent Review of Information Security | Independent review needs evidence, not narrative claims, to assess control effectiveness. |
| Recommendation — Collect review artefacts and test outputs that independently verify control operation. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Audit trails are the evidence basis for proving operational control behaviour. |
| Recommendation — Use audit records to substantiate control operation and investigate exceptions. | ||
Practitioner Guidance
What to prioritise: Start with the controls most likely to be tested for operating effectiveness, such as access governance, inventory accuracy, and recovery assurance. Those are the areas where evidence quality matters more than narrative completeness.
What to verify: Check that every questionnaire answer can be traced to a current artefact, an owner, and a date. If the evidence cannot be reproduced from operational systems, treat the answer as unverified.
Decision rule: If the question is “does this exist?”, a questionnaire may be enough for discovery. If the question is “can you prove it worked?”, move straight to records, logs, and test outputs.
Practitioner takeaway: In DORA programmes, questionnaires should drive evidence collection, not replace it; the closer you get to proving resilience, the more the answer must come from operational records.
Related resources from NHI Mgmt Group
- How should security teams prioritise NHI remediation in cloud environments?
- When should financial entities prioritise DORA controls over broader vendor management processes?
- When should teams prioritise continuous evidence collection over annual CyFun self-assessments?
- When should financial services teams prioritise customer experience over feature depth in digital products?