[non-validated] DORA SFS A / SF 0: Learning, staff readiness and information sharing
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] For the applicable entity role under DORA, have documented post-incident learning processes, security awareness training for all staff levels, and required information sharing arrangements been implemented as specified in Articles 13 and 45?
Explanation
[non-validated] For financial entities or ICT providers designated as critical under DORA, documented post-incident learning processes, security awareness training for all staff levels, and information sharing arrangements (where required by entity classification) must be implemented per Articles 13 and 45. Evidence must cover learning integration, training completion, and sharing participation conditional on entity role. Missing evidence remains pending.
Criterion and evidence
Verify applicable entity role (critical/non-critical), implementation of incident review processes incorporating lessons learned, staff training records covering current threats, and information sharing arrangements per DORA Articles 13/45. Evidence period: current regulatory review. Decision rule: all mandated components must be evidenced per entity's specific obligations; sharing participation is conditional and non-participation isn't automatically non-compliant.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for information sharing arrangements?
Evidence must demonstrate established sharing mechanisms compliant with Article 45 based on entity classification. Critical entities require documented arrangements with sectoral CERTs; non-critical entities don't require sharing. Non-participation isn't automatically non-compliant when not mandated by entity role.
How are missing components handled in evidence?
Full pass requires evidence for all three components (learning processes, training records, sharing arrangements per role). Partial evidence yields 'failed' outcome. Pending submission of incomplete evidence retains 'pending' status without negative presumption.
References
DORA: Learning, staff readiness and information sharing repository template