[non-validated] DORA SFS 1 / SF B: fields pending
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented incident response protocols as part of its digital operational resilience strategy per the repository's DORA topic description?
Explanation
[non-validated] Supporting fields await model review. Proposed positive criterion: Documented incident response protocols demonstrating defined actions, responsibilities, and escalation procedures meeting repository-specified requirements
Criterion and evidence
Actor: Entities covered by the repository's DORA topic boundaries for ICT risk framework and assurance, considering simplified regime applicability per repository guidelines based on size/risk profile. Scope: Documentation and implementation of incident response protocols within the digital operational resilience strategy per repository topic description. Evidence period: Current operational period up to assessment date. Required evidence: Documented incident response protocols explicitly referenced within the digital operational resilience strategy per repository keyDescription passage. Negative criterion: Absence of documented incident response protocols meeting repository-specified requirements. Missing evidence: Pending verification through documented incident response protocols; not an automatic negative outcome. Alternatives: For entities qualifying under simplified regime per repository guidelines, documented incident response protocols containing minimum elements specified in the repository description
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.