[non-validated] DORA: Incident Management and Classification - SF E (Incident Detection & Recording)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented documented procedures for detecting and recording all ICT-related incidents as required by DORA Articles 17 and 18 incident handling framework?
Explanation
[non-validated] Financial entities must maintain documented procedures for detecting and recording all ICT-related incidents in accordance with DORA Articles 17 and 18 incident handling framework. Evidence must demonstrate implementation through actual operational records, not merely procedural documentation.
Criterion and evidence
Applies to financial entities as defined in DORA Article 2(1-33). Requires documented detection procedures meeting Articles 17 and 18 requirements, with implementation evidence showing application to actual incidents (e.g., timestamped system logs). Missing evidence remains pending; no alternatives satisfy the criterion.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident management and classification. Record, handle and classify ICT-related incidents and significant cyber threats using an accountable process. Cover incident handling workflows, ownership, tracking, prioritisation, root cause and classification criteria. Distinguish ordinary incidents, major ICT-related incidents and significant cyber threats. SFS 7 owns reporting deadlines, forms and recipients. DORA article references: 17, 18. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented detection methodology meeting DORA Articles 17 and 18 requirements, with implementation evidence showing application to actual incidents (e.g., system logs with timestamped incident records). Evidence must demonstrate timely recording of all ICT-related incidents within operational workflows.
How are 'alternatives' treated under this criterion?
No recognized alternatives exist; compliance strictly requires documented detection procedures with implementation evidence as specified in DORA Articles 17 and 18. Partial documentation or theoretical frameworks without operational evidence remain non-compliant.
References
DORA: Incident management and classification