[non-validated] DORA: Comprehensive ICT Incident Classification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity ensured all ICT-related incidents are classified using established criteria for ordinary, major, and significant cyber threats as required by DORA Article 18(1)?
Explanation
[non-validated] Financial entities must classify all ICT-related incidents into defined categories (ordinary, major, significant cyber threats) using accountable processes to ensure proper handling and regulatory reporting under DORA requirements.
Criterion and evidence
Applies to financial entities per DORA Article 2(1-33). Requires comprehensive classification of all ICT incidents during the current audit cycle per Article 18(1), distinguishing ordinary incidents, major ICT-related incidents, and significant cyber threats. Evidence requires complete incident logs with applied classification tags and verification of no unclassified incidents. No valid alternatives exist for partial implementation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Complete incident logs showing classification tags applied to all ICT-related incidents per DORA Article 18(1), verified through audit trails confirming no unclassified incidents exist during the review period. Policy documents alone without implementation evidence are insufficient.
How are 'ordinary', 'major', and 'significant' incidents distinguished?
Classification must follow DORA Article 18(1) criteria and EBA RTS materiality thresholds. Ordinary incidents have minimal impact, major incidents disrupt operations temporarily, while significant cyber threats pose severe risks to service continuity or data integrity as defined in regulatory technical standards.
References
DORA: Incident management and classification
Base SF 006A definition