[non-validated] DORA SFS 5 / SF F: Detection capability testing across mandated incident types
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented evidence confirming testing of its detection capability across all required incident types (anomalous activity, performance issues, and ICT-related incidents) as specified in the repository topic allocation documentation for SFS 5?
Explanation
[non-validated] Has the entity documented evidence confirming testing of its detection capability across all required incident types (anomalous activity, performance issues, and ICT-related incidents) as specified in the repository topic documentation?
Criterion and evidence
Entity operating within DORA topic scope 5 boundaries must provide documented evidence showing testing of detection capability for anomalous activity, performance issues, and ICT incidents during the current operational period. Absence of complete coverage evidence results in pending status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Monitoring and anomalous activity detection. Detect anomalous activity, performance issues and ICT-related incidents using monitored evidence. Cover detection thresholds, logging, alerting, monitoring responsibilities, escalation triggers and testing of detection capability. SFS 6 owns handling/classification after detection; SFS 7 owns external reporting. DORA article references: 10. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of comprehensive testing?
Documented evidence must explicitly cover all three required incident types (anomalous activity, performance issues, ICT incidents) as defined in repository materials. Partial coverage is insufficient.
How are missing incident type tests handled?
Absence of documented evidence for any required incident type results in pending verification status. Testing documentation must cover all three mandated categories without exception.
References
DORA: Monitoring and anomalous activity detection