[non-validated] DORA SFS A / SF 3: Incident Notification Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity established documented procedures to notify competent authorities of relevant security incidents as required by its DORA classification?
Explanation
[non-validated] Does the entity have documented procedures for notifying competent authorities of relevant security incidents as required by its DORA classification per the DORA area description?
Criterion and evidence
Actor: Designated entity under DORA with obligations based on criticality and role classification. Scope: Implementation of documented incident notification procedures to competent authorities where mandated by entity classification per DORA area description boundaries. Evidence period: Current regulatory review period. Required evidence: Documented incident notification procedures compliant with DORA area description where applicable to entity classification. Negative criterion: Absence of documented incident notification procedures despite entity classification requiring reporting per DORA area description. Missing evidence: Pending submission of evidence regarding incident notification procedures and documentation status. Alternatives: No valid alternatives satisfy the criterion when entity classification requires notification; DORA area description mandates documented incident notification procedures where applicable to entity classification, with non-participation not automatically constituting failure when outside specified scope per explicit boundary condition
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for incident notification procedures?
Documented procedures showing submission records to competent authorities per entity classification as specified in the DORA area description. Non-applicability must be explicitly scoped out based on entity role; absence of documentation where mandated equals failure.
How do DORA Articles 13 and 45 apply to this requirement?
Articles establish requirements for critical entities. Evidence must reference these provisions per the DORA area description; non-participation is acceptable only when explicitly outside scope boundaries as defined in the area description.
References
DORA: Learning, staff readiness and information sharing