[non-validated] DORA SFS 7 / SF 4: Voluntary Cyber Threat Notification Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures for voluntarily notifying significant cyber threats to competent authorities as specified in the DORA topic allocation documentation?
Explanation
[non-validated] Financial entities must maintain documented procedures for voluntarily notifying competent authorities of significant cyber threats as mandated under DORA Articles 14, 19-23. This ensures proactive communication of emerging risks before they escalate into reportable incidents.
Criterion and evidence
Applies to financial entities under DORA Article 3. Requires documented voluntary cyber threat notification procedures referencing competent authorities per Articles 14, 19-23, with evidence dated after repository topic allocation publication. Missing evidence remains pending; no automatic negative assessment.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence validates compliance?
Documented internal procedures (v2.1 or newer) explicitly describing voluntary cyber threat notification workflows to competent authorities per DORA Articles 14, 19-23, dated within the current review period. Evidence must distinguish voluntary notifications from mandatory incident reporting requirements.
How are incomplete procedures assessed?
Procedures covering only mandatory reporting (e.g., payment incidents under Article 19) without voluntary threat notification elements remain pending. Partial documentation does not satisfy the requirement; missing evidence is neither automatically failed nor presumed compliant.
References
DORA: Incident reporting and communications