[non-validated] DORA SFS 5 / SF B: Repository-Defined Severity Thresholds for Incident Handoff
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented the severity thresholds or conditions that trigger handoff of detected anomalous activity, performance issues, or ICT-related incidents to the classification/handling team (SFS 6) as specified in the repository topic allocation documentation?
Explanation
[non-validated] Has the entity documented specific severity thresholds or conditions that trigger transfer of detected anomalous activity, performance issues, or ICT-related incidents to the classification/handling team (SFS 6) as defined in repository topic allocation documentation?
Criterion and evidence
Verify repository-documented evidence of severity-based handoff criteria (e.g., incident severity matrix) to SFS 6 during current operational period per topic 5 keyDescription passage. Distinct from SF A's handoff mechanism coverage; excludes SFS 6/SFS 7 classification responsibilities. Missing criteria = pending evidence status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this criterion?
Repository-described severity matrix or documented conditions specifying when incidents trigger handoff to SFS 6 during operational period (e.g., Level 1 incidents require immediate transfer). Template fields must be populated with entity-specific thresholds from repository materials.
Are there acceptable alternatives to defined severity thresholds?
No valid alternatives per repository documentation; absence of defined severity criteria results in automatic failure status. Pending applies only when repository-described parameters are unavailable.
References
DORA: Monitoring and anomalous activity detection