[non-validated] DORA SFS 7 / SF 3: Voluntary notification of significant cyber threats
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the applicable entity submitted a voluntary notification of a significant cyber threat to its competent authority under Regulation (EU) 2022/2554?
Explanation
[non-validated] Has the financial entity that is allowed, on a voluntary basis, to notify significant cyber threats submitted such a voluntary notification to its competent authority under Regulation (EU) 2022/2554 during the review period?
Criterion and evidence
Determine whether the applicable financial entity chose to exercise its voluntary right under DORA Recital 24 to notify a significant cyber threat to the competent authority, evidenced within the review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence confirms the voluntary notification was submitted to the competent authority?
A verified notification record submitted directly to the competent authority under Regulation (EU) 2022/2554. Acceptable evidence includes an acknowledgment of receipt, reference number, or submission confirmation issued by the competent authority. Notification to a private entity, self-held logs, or internal records alone do not satisfy this criterion. Because notification is voluntary, absence of notification does not of itself indicate non-compliance; missing evidence is pending.
Which entities are in scope and how is the evidence period determined?
In scope is any financial entity that DORA Recital 24 allows, on a voluntary basis, to notify a significant cyber threat. The evidence period is the current review period; evidence must be dated after publication of the effective regulatory texts. The competent authority is the authority designated under DORA Article 19 for the reporting financial entity; one authority does not cover every entity across all jurisdictions.
How are alternatives handled when no voluntary notification exists?
No alternative satisfies this criterion; a voluntary notification to the competent authority is the only evidence that the financial entity chose to notify a significant cyber threat under Regulation (EU) 2022/2554. This SF is distinct from the initial (4-hour), intermediate (72-hour), and final (1-month) mandatory incident reports under DORA Articles 14, 19, 20, 21, 22, 23.
References
DORA: Incident reporting and communications
Regulation (EU) 2022/2554 of the European Parliament and of the Council on digital operational resilience for the financial sector (DORA)
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554 (opens in a new tab)