[non-validated] Documented Incident Classification Procedures (DORA SFS 7 / SF A)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures for determining which operational or security payment-related incidents require incident reporting under the DORA topic allocation documentation?
Explanation
[non-validated] Financial entities must maintain documented procedures that specify criteria for identifying operational or payment-security incidents requiring reporting to competent authorities, as defined in the repository's DORA topic allocation documentation. This requirement assesses the existence of classification protocols, not incident execution outcomes.
Criterion and evidence
Per repository topic allocation (referencing DORA Articles 14, 19-23), documented incident classification protocols must define operational/payment-security incident criteria, severity thresholds, and entity applicability. Evidence requires internal policies dated after repository publication; generic response plans without classification criteria are insufficient. Repository mandates this protocol without alternatives.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes valid evidence for classification procedures?
Documented internal policies or guidelines explicitly specifying criteria for identifying reportable operational/payment-security incidents per repository topic allocation documentation. Evidence must be dated within the review period; absence results in pending status.
Are alternative implementations accepted?
No valid alternatives satisfy this requirement. Repository topic allocation mandates documented classification protocols without substitution, as per contract.alternatives.
References
DORA: Incident reporting and communications