[non-validated] DORA SFS 7 / SF 9: Payment-Related Incident Reporting Scope
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity reported all applicable operational or security payment-related incidents to the competent authority using current reporting requirements as specified in the DORA topic allocation documentation?
Explanation
[non-validated] Does the financial entity report all applicable operational or security payment-related incidents to the competent authority as specified in the repository's DORA topic allocation documentation, including timely submission of required reports where applicable?
Criterion and evidence
Confirm applicable financial entity under repository-defined DORA scope has documented evidence of reporting all operational/payment-security incidents per repository topic allocation documentation within required timeframes (e.g., initial notification, intermediate/final reports). Evidence must include verified submission records; pending if none. No alternatives satisfy the requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence is required to satisfy this requirement?
Verified submission records confirming reporting of all applicable operational/payment-security incidents per repository topic allocation documentation, including classification details and adherence to specified timeframes. Pending if evidence is missing.
Are alternative reporting methods acceptable?
No valid alternatives; repository topic allocation documentation mandates reporting of all applicable incidents without substitution options.
References
DORA: Incident reporting and communications