[non-validated] DORA SFS 5 / SF 4 (Monitoring and anomalous activity detection)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Does the entity maintain documented evidence confirming actual detection of anomalous activity, performance issues, or ICT-related incidents through its monitoring system during the current operational period?
Explanation
[non-validated] Does the entity maintain documented evidence demonstrating actual detection of anomalous activity, performance issues, or ICT-related incidents through its monitoring systems during the current operational period?
Criterion and evidence
Verify entity applicability under DORA topic scope 5 (Article 10); evidence must document actual detection events (anomalous traffic, performance degradation, ICT incidents) per repository-specified operational period. Absence of evidence = pending status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Documented records (e.g., logs, incident reports) confirming identification of specific anomalous events during operational period per repository keyDescription passage. Must demonstrate actual detection events, not system capability descriptions. Absence results in pending status per fixture-0054-3.
References
DORA: Monitoring and anomalous activity detection