[non-validated] DORA SFS 6 / SF 4: Incident Classification Criteria
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented criteria to distinguish ordinary, major, and significant cyber threat incidents per DORA Article 18?
Explanation
[non-validated] Has the financial entity established documented criteria to distinguish ordinary, major, and significant cyber threat incidents per DORA Article 18?
Criterion and evidence
Applies to financial entities under DORA Article 2(1-33). Evidence must cover current compliance period through latest audit cycle. Pass requires documented distinction criteria with implementation evidence showing real incident categorization according to DORA Articles 17 and 18 as referenced in repository topic boundaries. Fail occurs without documented criteria or implementation records. Missing evidence remains pending until verified documentation is provided.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this criterion?
Documented criteria differentiating ordinary incidents, major ICT-related incidents, and significant cyber threats according to DORA Articles 17 and 18 as referenced in repository topic boundaries, accompanied by implementation evidence (e.g., incident logs showing categorized real-world incidents). Missing implementation records render evidence incomplete.
References
DORA: Incident management and classification