{"id":1424,"date":"2026-01-06T20:08:44","date_gmt":"2026-01-06T19:08:44","guid":{"rendered":"https:\/\/regulated-devsecops.com\/uncategorized\/dora-article-21-auditor-checklist-ci-cd-ict-risk-management-2\/"},"modified":"2026-03-26T00:24:54","modified_gmt":"2026-03-25T23:24:54","slug":"dora-article-21-auditor-checklist-ci-cd-ict-risk-management","status":"publish","type":"post","link":"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/dora-article-21-auditor-checklist-ci-cd-ict-risk-management\/","title":{"rendered":"DORA Article 21 \u2014 Liste de contr\u00f4le de l\u2019auditeur (CI\/CD & gestion des risques ICT)"},"content":{"rendered":"\n

This checklist is designed to assess compliance with DORA Article 21 requirements through CI\/CD pipeline controls and supporting ICT processes.
It supports internal audits, supervisory reviews, and regulatory assessments.<\/p>\n\n\n\n

\n\n\n\n

Article 21(1) \u2014 ICT Risk Management Framework<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
CI\/CD pipelines are included in the ICT risk management scope<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
ICT risks related to software delivery are formally identified<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Preventive controls are enforced via CI\/CD pipelines<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Detection mechanisms exist for pipeline-related incidents<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
CI\/CD supports response and recovery processes<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Article 21(2)(a) \u2014 Access Control<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
CI\/CD access follows least privilege principles<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Pipeline identities are separated from human users<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
RBAC is enforced for pipeline configuration<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Le MFA est requis pour les administrateurs CI\/CD<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Privileged actions are restricted and monitored<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Article 21(2)(b) \u2014 Segregation of Duties<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
Developers cannot self-approve production changes<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Code review is mandatory before pipeline execution<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Build and deploy permissions are separated<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Overrides and exceptions are logged<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Segregation of duties is reviewed periodically<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Article 21(2)(c) \u2014 Logging and Monitoring<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
All CI\/CD executions are logged<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Logs include approvals and security checks<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Logs are centrally collected<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Log retention meets regulatory requirements<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Alerts exist for abnormal pipeline behavior<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Article 21(2)(d) \u2014 Change Management & Integrity<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
Tous les changements en production passent par les pipelines CI\/CD<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Artifact integrity is verified before deployment<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Provenance links source code to deployed artifacts<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Out-of-band deployments are prevented or logged<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Change approvals are auditable<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Article 21(2)(e) \u2014 Resilience, Backup, and Recovery<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
CI\/CD pipelines are designed for resilience<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Build environments are isolated and hardened<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Pipeline configurations are backed up securely<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Rollback procedures are tested<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
CI\/CD components do not represent single points of failure<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Article 21(2)(f) \u2014 Continuous Improvement<\/h2>\n\n\n\n
Control Check<\/strong><\/th>Yes<\/strong><\/th>No<\/strong><\/th><\/tr><\/thead>
CI\/CD security controls are reviewed periodically<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Pipeline controls evolve with threat landscape<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Lessons learned are fed back into pipelines<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Compliance gaps trigger corrective actions<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr>
Management oversight includes CI\/CD risk posture<\/td>\u2b1c<\/td>\u2b1c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Auditor Guidance<\/h2>\n\n\n\n

When using this checklist:<\/p>\n\n\n\n