[non-validated] DORA SFS 6: ICT Incident Classification Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented documented procedures to classify ICT-related incidents as significant cyber threats according to DORA Articles 17 and 18 requirements?
Explanation
[non-validated] Has the financial entity established documented procedures to classify ICT-related incidents as significant cyber threats in compliance with DORA Articles 17 and 18 requirements?
Criterion and evidence
Applies to financial entities per DORA Article 2(1-33). Evidence must cover current compliance period through latest audit cycle. Pass requires documented classification procedures meeting DORA Articles 17-18 requirements, with implementation evidence showing application to real incidents (e.g., incident logs with threat categorization determinations). Fail occurs without documented procedures or implementation evidence. Pending when classification documentation or application records are missing.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence confirms compliance with this condition?
Documented classification procedures meeting DORA Articles 17-18 requirements applied to real ICT-related incidents, with records showing categorization of significant cyber threats (e.g., incident logs containing threat classification determinations and evidence of procedural application).
How are missing evidence cases assessed?
Pending classification procedures documentation or implementation records (e.g., missing incident logs showing threat categorization) result in 'pending' status; absence of both documented procedures and implementation evidence constitutes failure.
References
DORA: Incident management and classification