[non-validated] DORA SFS 7 / SF 5: Maintained Accountability in Delegated Incident Reporting
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures ensuring maintained accountability for incident reporting when ICT services are delegated to third parties, as specified in the DORA topic allocation documentation?
Explanation
[non-validated] Does the financial entity maintain documented procedures ensuring direct accountability for incident reporting when ICT services are delegated to third parties, as specified in the repository's DORA topic allocation documentation?
Criterion and evidence
Applies to financial entities under DORA framework per repository topic allocation (Articles 14, 19-23). Requires documented procedures confirming maintained accountability during delegated incident reporting as defined in pinned repository documentation. Evidence must be dated within the current review period. Based solely on repository text; no external verification under repo-only constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies the accountability requirement during delegation?
Documented internal procedures confirming maintained accountability during delegated incident reporting per repository topic allocation documentation, dated within the review period. Must include verification mechanisms and competent authority notification processes. No valid alternatives exist under repository requirements.
How is missing evidence handled for this condition?
Pending until verification evidence is provided. Missing evidence does not constitute automatic failure but requires active documentation collection. Evidence must specifically address maintained accountability during delegation, not general incident reporting.
References
DORA: Incident reporting and communications