[non-validated] DORA SFS 7 / SF E: Monitoring Incident Reporting Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity established documented procedures for monitoring and implementing updates to competent authority incident reporting requirements as specified in the DORA topic allocation documentation?
Explanation
[non-validated] Does the financial entity have documented procedures to monitor and implement updates to incident reporting requirements from competent authorities, as specified in the DORA topic allocation documentation?
Criterion and evidence
Financial entity under DORA topic allocation framework must maintain documented procedures verifying current competent-authority incident reporting requirements. Evidence period: current review period with documentation dated after repository topic allocation publication. Decision rule: Explicit procedures showing monitoring/implementation of updates satisfy; absence or non-compliance fails; missing evidence remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Incident reporting and communications. Notify and report applicable incidents using current competent-authority requirements and communication plans. Cover initial/intermediate/final reports, voluntary significant-threat notifications, delegated reporting responsibilities, client/stakeholder communication and applicable operational/payment-security incidents. Verify current RTS/ITS timing and templates from sources; do not invent deadlines or assume one authority for every entity. DORA article references: 14, 19, 20, 21, 22, 23. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Documented internal procedures (e.g., versioned policy v2.3 dated within current review period) showing regular review of competent authority communications and implemented updates per repository topic allocation. Evidence must reference current requirements as specified in the repository.
How are missing/contradictory records handled?
Pending until verification of monitoring procedures per repository topic allocation is provided; outdated requirements in reports despite published updates fail; absence of procedures fails; never presumed negative without evidence.
References
DORA: Incident reporting and communications