[non-validated] DORA SFS 7 / SF 6: Client and Stakeholder Communication Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures for client and stakeholder communication during applicable operational or security payment-related incidents, as specified in the DORA topic allocation documentation?
Explanation
[non-validated] Does the financial entity maintain documented procedures for communicating with clients and stakeholders during operational or security payment-related incidents, as specified in the repository topic allocation?
Criterion and evidence
Assess documented client/stakeholder communication protocols for financial entities during payment/security incidents per repository topic allocation. Evidence must confirm procedures exist specifying notification channels, timelines, and stakeholder groups for applicable incidents within the review period. Missing evidence remains pending; no compliance judgment implied.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented internal procedures explicitly specifying communication channels, notification timelines, and stakeholder groups for operational/security payment incidents as defined in repository topic allocation. Evidence must be dated within the review period.
How is missing evidence handled?
Pending until verifiable documentation is provided; never presumed negative. Repository allocation requires explicit client/stakeholder communication protocols – absence of evidence blocks confirmation but doesn't constitute failure.
References
DORA: Incident reporting and communications