[non-validated] DORA SFS 6 / SF 5: fields pending
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented a documented process for conducting root cause analysis on major ICT-related incidents as required by DORA's incident management framework?
Explanation
[non-validated] Supporting fields await model review. Proposed positive criterion: Documented root cause analysis process exists with implementation evidence for major incidents
Criterion and evidence
Actor: Financial entities as defined in DORA Article 2(1-33). Scope: ICT incident root cause analysis under DORA requirements. Evidence period: Current compliance period through most recent audit cycle. Required evidence: Documented root cause analysis process covering identification of underlying causes and implemented remediation actions for major incidents; Implementation evidence showing application to real major incidents (e.g., analysis reports with remediation outcomes). Negative criterion: No documented process or implementation evidence for root cause analysis. Missing evidence: Pending until root cause analysis documentation and implementation records are provided. Alternatives: No recognized alternatives; compliance requires adherence to DORA's incident management requirements for root cause analysis
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.