[non-validated] DORA SFS A / SF 6: Incorporation of incident/test lessons into security awareness training
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity incorporated incident and test lessons into documented security awareness training for staff and management as required by the DORA area description?
Explanation
[non-validated] For DORA-designated entities with applicable obligations, has documented security awareness training for staff and management explicitly incorporated lessons derived from security incidents and tests? Evidence must include version-controlled training materials referencing incident/test lessons and verified delivery records demonstrating integration during the current regulatory period. Non-applicability requires explicit scope-out based on entity classification; no valid alternatives satisfy the requirement when mandated.
Criterion and evidence
Actor: Entity designated under DORA with obligations based on criticality and role classification. Scope: Implementation of documented security awareness training incorporating incident/test lessons for staff and management as specified in DORA area description requirements. Evidence period: Current regulatory review period. Required evidence: Documented security awareness training materials with version control explicitly referencing incident/test lessons; Verified evidence of training delivery covering incident/test lesson integration during the evidence period. Negative criterion: Absence of documented implementation showing incorporation of incident/test lessons into security awareness training. Missing evidence: Pending submission of security awareness training materials demonstrating incorporation of incident/test lessons. Alternatives: No valid alternatives satisfy the criterion; DORA area description mandates incorporation of incident/test lessons into security awareness training for staff and management, with no permissible substitutions for this requirement as part of resilience improvement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of incident/test lesson incorporation?
Documented security awareness training materials must explicitly reference incident/test lessons with version control, plus verified delivery records showing coverage for staff and management during the evidence period. Evidence must align with entity's DORA classification; non-applicability requires explicit scope-out per area description boundaries.
References
DORA: Learning, staff readiness and information sharing