[non-validated] DORA SFS 5 / SF 2: Entity-Executed Detection Capability Testing
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity executed documented testing of its detection capability for anomalous activity, performance issues, and ICT-related incidents as described in repository topic allocation documentation?
Explanation
[non-validated] Has the entity tested its detection mechanisms for anomalous activity, performance issues, and ICT incidents through documented testing as specified in repository topic materials?
Criterion and evidence
Validate entity-executed testing of detection capability per repository-specified evidence requirements during documented operational period, covering detection thresholds, logging, alerting and escalation triggers.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for detection capability verification?
Repository-documented test reports showing successful identification of simulated anomalous traffic, performance degradation scenarios, and ICT incidents during validation period. Evidence must specify tested thresholds, logging coverage, alert mechanisms and escalation triggers per topic materials.
How are missing or contradictory test results handled?
Pending verification status applies when repository-described test validation fields are incomplete or conflicting. Scheduled tests without executed validation records do not satisfy the requirement.
References
DORA: Monitoring and anomalous activity detection