[non-validated] DORA SFS 6 / SF 7: Impact Determination Procedures under Articles 17-18
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures for determining the business impact of ICT-related incidents using materiality thresholds specified in DORA Articles 17-18?
Explanation
[non-validated] Has the financial entity established documented procedures for determining the impact of ICT-related incidents using materiality thresholds specified in DORA Articles 17-18?
Criterion and evidence
For financial entities under DORA Article 2(1-33), verify documented impact determination procedures meeting Articles 17-18 criteria using repository sources. Evidence period covers current compliance cycle through last audit. Pending if documentation or implementation records are missing.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for impact determination procedures?
Documented procedures showing application of DORA Articles 17-18 criteria to real incidents (e.g., incident logs with quantified business impact measurements). Repository templates require clear materiality thresholds and implementation records.
How is missing evidence handled for this condition?
Pending classification when procedure documentation exists but implementation records (e.g., incident logs with applied impact assessments) are missing. Not satisfied by theoretical frameworks alone.
References
DORA: Incident management and classification