[non-validated] DORA SFS 6 / SF D: Incident ownership accountability (unverified draft)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented and implemented clear ownership assignments for handling ICT-related incidents according to DORA Articles 17 and 18 accountability requirements?
Explanation
[non-validated] Has the financial entity documented and implemented clear ownership assignments for handling ICT-related incidents according to DORA Articles 17 and 18 accountability requirements? [Unverified draft based on repository topic allocation]
Criterion and evidence
Assess financial entities (DORA Article 2(1-33)) for documented ownership assignment framework meeting Articles 17-18 requirements during current compliance period. Pass requires policy implementation evidence with real incident logs showing assigned owner records. Fail occurs without documentation or implementation. Missing evidence remains pending until ownership framework documentation and implementation records are provided. No alternatives satisfy the requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence should be checked for ownership assignment?
Documented incident management policy specifying owner roles with implementation evidence showing application to real incidents (e.g., incident logs containing assigned owner records, resolution actions, and management oversight per DORA Articles 17-18)
How are missing ownership records handled?
Pending until verified documentation of ownership framework and implementation records are provided; no recognized alternatives satisfy DORA Articles 17-18 accountability requirements
References
DORA: Incident management and classification