[non-validated] DORA Topic 5 / SF 0: Monitoring and Anomalous Activity Detection
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented monitoring mechanisms that detect anomalous activity, performance issues, and ICT-related incidents using the detection thresholds, logging procedures, and alerting parameters described in the repository topic allocation documentation?
Explanation
[non-validated] Does the entity operate monitoring mechanisms that detect anomalous activity, performance issues, and ICT-related incidents using the detection thresholds, logging procedures, and alerting parameters specified in the pinned topic allocation documentation?
Criterion and evidence
Implementation must cover detection thresholds, logging mechanisms, alerting procedures, and testing of detection capability as defined in the pinned topic allocation documentation. Evidence period aligns with documented operational records; SFS 6 handles incident classification and SFS 7 manages external reporting per repository structure.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliant monitoring mechanisms?
Evidence must include documented detection thresholds, logging mechanisms, alerting procedures, and testing results demonstrating operational capability as specified in the pinned topic allocation documentation. Alternatives may include verification records showing validation during documented operational periods.
How is missing evidence handled for this requirement?
When parameters described in the pinned topic allocation documentation are unavailable, the status remains pending verification until documented evidence meeting repository-specified parameters is provided. No automatic negative result is assumed.
References
DORA: Monitoring and anomalous activity detection