[non-validated] DORA SFS 5 / SF D: Periodic Review of Escalation Triggers
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented periodic review and adjustment of escalation triggers for detected anomalous activity, performance issues, and ICT-related incidents as specified in the repository topic allocation documentation?
Explanation
[non-validated] Has the entity documented periodic review and adjustment of escalation triggers for detected anomalous activity, performance issues, and ICT-related incidents as specified in the repository topic allocation documentation? Verification requires evidence of scheduled review cycles during operational period. Missing evidence remains pending; no alternative compliance methods are accepted per repository requirements.
Criterion and evidence
Applies to entities operating within DORA topic scope 5 boundaries. Evidence period aligns with current documented operational cycle. Verification requires repository-described evidence confirming scheduled review intervals for escalation triggers (e.g., quarterly logs showing updated triggers for anomalous traffic detection). Non-applicability must be explicitly scoped based on entity role and regime classification. Missing evidence remains pending; no automated pass/fail assumed.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence should be checked for escalation trigger reviews?
Repository-described evidence confirming scheduled review intervals (e.g., quarterly logs) showing updated escalation triggers for anomalous activity, performance issues and ICT incidents during operational period. Non-compliance with documented review cycle parameters results in pending status.
Are there any acceptable alternatives to the specified review process?
No valid alternatives are accepted per repository documentation. Proportionality adjustments require explicit exception documentation, not alternative review methodologies.
References
DORA: Monitoring and anomalous activity detection