[non-validated] DORA SFS 5 / SF E: Detection Capability Testing Validation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented evidence confirming testing of its detection capability for anomalous activity, performance issues, and ICT-related incidents as specified in the repository topic allocation documentation?
Explanation
[non-validated] Has the entity documented evidence confirming testing of its detection capability for anomalous activity, performance issues, and ICT-related incidents as specified in the repository topic allocation documentation?
Criterion and evidence
Assess documented evidence of detection capability testing for anomalous activity, performance issues, and ICT-related incidents during current operational period per repository-specified requirements. Applies to DORA-covered entities under simplified/standard regime. Missing evidence remains pending; no automated failure assumed.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for detection capability testing?
Documented test reports showing validation across all required incident types (anomalous activity, performance issues, ICT incidents) per repository description. Evidence must cover detection thresholds, logging, and alert mechanisms. Partial documentation or test schedules alone are insufficient.
How is missing evidence handled?
Validation remains pending when repository-described evidence parameters for detection capability testing are unavailable. This does not constitute automatic failure. 'No route found' applies only when repository-defined implementation path is infeasible within stated constraints.
References
DORA: Monitoring and anomalous activity detection