[non-validated] DORA Area A, SF D: Documented Incident Review Procedures for Lessons Learned
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity maintained documented incident review procedures that analyze security incidents and tests to identify lessons for improvement as required by the DORA area description?
Explanation
[non-validated] Has the applicable entity maintained documented incident review procedures that analyze security incidents and tests to identify lessons for improvement, per DORA Articles 13 and 45 requirements?
Criterion and evidence
Assesses whether designated critical entities under Regulation (EU) 2022/2554 maintain documented procedures for analyzing security incidents/tests to identify risk-applicable lessons. Evidence period: current regulatory review period. Entity role: financial entities/ICT providers designated as critical; non-applicability requires explicit scope-out based on size/exemptions. Conditional sharing participation per Article 45 must be evaluated separately from incident analysis obligations.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies the requirement for documented incident review procedures?
Version-controlled procedures demonstrating systematic analysis of security incidents/tests with verifiable outputs identifying applicable lessons for the entity's risk profile. Evidence must cover post-incident learning cycles within the current regulatory period.
How does entity classification affect this assessment?
Obligations apply only to entities designated as critical under DORA with specified roles. Non-critical entities require explicit scope-out documentation. Simplified regime applicability must be confirmed per entity size/criticality thresholds.
References
DORA: Learning, staff readiness and information sharing