[non-validated] DORA SFS 6 / SF 2 (Incident classification)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity classified ICT-related incidents based on impact criteria as required by DORA Article 18(1)?
Explanation
[non-validated] Has the financial entity classified ICT-related incidents based on impact criteria as required by DORA Article 18(1)?
Criterion and evidence
Assess financial entities (per DORA Article 2) for documented incident classification criteria meeting Article 18(1) impact requirements, with evidence from current audit period. Verify entity role applicability and implementation against real incidents.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of incident classification?
Documented classification policy with materiality thresholds (per Article 18(1)) applied to real incident logs showing impact assessment and categorization. Evidence must demonstrate application to actual incidents, not just policy existence.
How is missing evidence handled?
Classification policy without implementation records (e.g., logs) leaves status pending. Missing evidence does not imply failure; verification requires active demonstration of applied classification criteria to real incidents.
References
DORA: Incident management and classification