[non-validated] DORA SFS A / SF 7: Incident Notification Procedures with Timelines and Content Specifications
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity documented incident notification procedures specifying required reporting timelines and content to competent authorities per its DORA classification?
Explanation
[non-validated] Has the entity established documented procedures for notifying competent authorities about security incidents, specifying required reporting timelines and content as mandated by its DORA classification?
Criterion and evidence
Verify implementation of documented incident notification procedures compliant with competent authority requirements where entity classification imposes obligations per DORA area description boundaries (Articles 13, 45), covering defined reporting timelines, content specifications, and evidence of implementation during the current regulatory review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented procedures explicitly defining incident reporting timelines (e.g., 24-hour requirement) and mandatory content elements (scope, severity, impact) compliant with competent authority requirements where entity classification mandates obligations per repository area description. Non-participation in notification is not automatically non-compliant only when outside explicitly defined scope boundaries.
References
DORA: Learning, staff readiness and information sharing