[non-validated] DORA SFS 6 / SF 8: ICT Incident Handling Mechanisms
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented incident handling workflows with defined ownership, tracking, and prioritization procedures as required by DORA Recital 21?
Explanation
[non-validated] Does the financial entity have specific mechanisms and policies for handling ICT-related incidents with defined ownership, tracking, and prioritization procedures as required by DORA Recital 21?
Criterion and evidence
Applies to financial entities per DORA Article 2(1-33). Requires mechanisms and policies for ICT incident handling demonstrating implementation evidence covering ownership assignment, tracking history, and materiality-based prioritization. Evidence period: current compliance cycle through latest audit cycle. Based on DORA Recital 21 'specific mechanisms and policies for handling all ICT-related incidents' (source passage: p1). Documentation is implied by policy implementation but not explicitly mandated in source text.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Evidence demonstrating specific mechanisms and policies for handling ICT-related incidents (per DORA Recital 21), such as documented workflows showing implementation through incident logs with ownership assignment, tracking history, and prioritization based on materiality thresholds. Documentation is an implementation method but not explicitly required by source text; alternatives may exist if they fulfill the 'mechanisms and policies' mandate. Missing evidence remains pending.
References
DORA: Incident management and classification