[non-validated] DORA SFS 7 / SF 8: Competent Authority Determination for Incident Reporting
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented its specific competent authority for incident reporting as determined by its entity classification under the DORA topic allocation framework?
Explanation
[non-validated] The financial entity must document its specific competent authority for incident reporting as determined by its entity classification under the DORA topic allocation framework (draft taxonomy). This ensures timely reporting of ICT-related incidents to the correct regulator, covering initial/intermediate/final reports, voluntary significant-threat notifications, delegated responsibilities, and stakeholder communication as specified in the repository topic allocation documentation.
Criterion and evidence
Verify documented entity-specific competent authority determination per repository topic allocation. Evidence must reference entity classification (e.g., payment institution vs. credit institution), correct authority designation (national vs. EBA), and reporting timelines. Excludes incorrect authorities or undocumented determinations.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of competent authority determination?
Documented determination (e.g., v1.3 dated 2026-08-01) confirming correct authority based on entity classification per repository topic allocation. National banking authority for payment institutions; EBA for cross-border cases. No valid alternatives satisfy this requirement.
How are missing evidence cases handled?
Pending until verification is provided. Documented incident reports alone are insufficient without authority determination evidence. Never presumed negative; requires explicit documented classification-based designation.
References
DORA: Incident reporting and communications