[non-validated] DORA SFS 7 / SF B: Incident classification under repository topic allocation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity applied the incident classification criteria from the DORA topic allocation documentation to determine if an ICT-related incident qualifies as major and requires reporting?
Explanation
[non-validated] Has the financial entity applied the incident classification criteria specified in the repository topic allocation documentation to determine if an ICT-related incident qualifies as major and requires reporting? Evidence must verify consistent application of repository-specified classification standards for ICT-related incidents affecting operational resilience.
Criterion and evidence
Verifies implementation of incident classification criteria for major ICT-related incidents requiring reporting per repository topic allocation documentation (v2.0). Evidence period: documentation dated after repository publication. Missing evidence remains pending; no automatic negative presumption.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented incident records demonstrating application of repository topic allocation classification criteria with impact assessments (v2.0). Example: Classification of 3 major ICT incidents showing adherence to repository-specified thresholds.
How are misclassifications or missing evidence treated?
Evidence showing internal thresholds inconsistent with repository topic allocation criteria is non-compliant. Absence of classification documentation renders status pending; scheduling alone does not satisfy the requirement. No valid alternatives exist for the mandated criteria.
References
DORA: Incident reporting and communications