[non-validated] Critical ICT Provider Incident Reporting Obligations Under DORA Article 37(1)-(2)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider reported all ICT-related incidents to the competent authority within required timeframes as mandated by DORA Article 37(1)-(2)?
Explanation
[non-validated] Has the entity formally designated as a critical ICT provider under DORA Article 14 reported all ICT-related incidents to competent authorities within mandated timeframes per DORA Article 37(1)-(2)? Evidence must show documented submission with acknowledgment; missing evidence remains pending.
Criterion and evidence
Assess designated critical ICT provider (exclusively DORA Article 14 entities) obligations under Article 37(1)-(2). Evidence requires dated incident reports with competent authority reference numbers and electronic acknowledgment timestamps within current DORA implementation period. Absence of documentation constitutes non-compliance; missing evidence remains pending. No valid alternatives satisfy Article 37 specifications.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of compliance?
Documented incident reports dated within current DORA implementation period showing direct submission to competent authority with reference number, electronic acknowledgment timestamp, and explicit indication of regulatory receipt per Article 37(1)-(2). Absence of such documentation constitutes non-compliance.
Which entities fall under this requirement?
Only entities formally designated as 'critical ICT providers' under DORA Article 14. Excludes financial entities (covered by separate legislation) and ordinary ICT providers without critical designation.
References
DORA: Critical provider oversight and supervisory readiness