[non-validated] DORA SFS 6 / SF C
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures for regularly reviewing and updating ICT incident classifications in accordance with DORA's accountability framework?
Explanation
[non-validated] Define the applicable entity role, condition, evidence period and decision rule for incident classification procedures within the DORA framework.
Criterion and evidence
Define the applicable entity role, condition, evidence period and decision rule from repository-verified DORA sources without legal verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Repository-defined documentation of classification procedures meeting incident handling workflows described in area keyDescription; no legal verification performed under repo-only mode.
Are alternatives permitted?
No alternatives specified in repository sources; pending until verified statutory evidence is admitted. Repository templates prohibit deviations from defined classification criteria.
References
DORA: Incident management and classification