Draft catalog: 16 sets and 256 questions. Browse the catalog →
Catalog
Browse sets
SFS 6 — Incident management and classification
[non-validated] DORA SFS 6 / SF B: fields pending

[non-validated] DORA SFS 6 / SF B: fields pending

Generated catalog draft. No operational assessment or human approval is claimed.

[non-validated] This question has unresolved selected work.

Question

[non-validated] Has the financial entity documented and implemented procedures for escalating ICT-related incidents to senior management as required by DORA Recital 21?

Explanation

[non-validated] Supporting fields await model review. Proposed positive criterion: Documented escalation procedures exist with implementation evidence showing application to real incidents

Criterion and evidence

Actor: Financial entities as defined in DORA Article 2(1-33). Scope: ICT incident escalation procedures under DORA framework. Evidence period: Current compliance period through most recent audit cycle. Required evidence: Documented escalation workflow meeting accountability requirements in DORA Recital 21; Implementation evidence showing application to actual incidents requiring senior management notification (e.g., incident logs with escalation timestamps and management acknowledgments). Negative criterion: No documented escalation procedures or implementation evidence. Missing evidence: Pending until escalation procedures documentation and implementation records are provided. Alternatives: No recognized alternatives; compliance requires documented escalation procedures per DORA framework

AI assistance prompt

Investigate the exact question: 'Has the financial entity documented and implemented procedures for escalating ICT-related incidents to senior management as required by DORA Recital 21?'

  1. Primary source verification:

    • Access full text of Regulation (EU) 2022/2554 via EUR-Lex to confirm Recital 21 content (currently missing from frozen passages)
    • Verify if Recital 21 explicitly mandates escalation procedures or references Article 17(2) which establishes incident management requirements
    • Check Commission Delegated Regulation (EU) 2024/1772 effective date status (currently null in frozen metadata)

  2. Critical scoping requirements:

    • Confirm financial entity classification per DORA Article 2(1-33)
    • Determine applicability of standard/simplified regime
    • Identify if TLPT designation affects escalation requirements

  3. Evidence protocol:

    • Request documented escalation workflow meeting Article 17(2) requirements (not Recital 21 which lacks verifiable content in current sources)
    • Require implementation evidence showing real incident application (e.g., timestamped logs with management acknowledgments)
    • Distinguish from SFS 7 reporting requirements and SFS 4 classification criteria

  4. Research boundaries:

    • ESMA operational instructions cannot be verified (only title exists in frozen sources)
    • Commission Delegated Regulation (EU) 2024/1772 applicability is pending effective date confirmation
    • Never assume requirements beyond verified primary sources

  5. Mandatory uncertainty flags:

    • 'Verification requires full Recital 21 text - current frozen sources contain only document title'
    • 'Delegated Regulation 2024/1772 status pending effective date confirmation'
    • 'ESMA instructions content unverified - only title available in frozen sources'
    • 'Evidence complete only when implementation records show real incident application'

DO NOT assert compliance. Return 'pending' for missing evidence. Cite only directly verified primary sources (Regulation (EU) 2022/2554 full text via EUR-Lex). Reference frozen source limitations explicitly.

Clarifications

References