[non-validated] DORA SFS F / SF E: Incident severity categorization under Article 36
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider categorized ICT-related incidents by severity level and maintained complete incident logs as required by DORA Article 36?
Explanation
[non-validated] Does the designated critical ICT provider categorize ICT-related incidents by severity level and maintain complete incident logs as mandated by DORA Article 36?
Criterion and evidence
Actor: Entity formally designated as critical ICT provider under DORA Article 14 (excludes financial entities/ordinary ICT providers). Scope: DORA Article 36(1)-(2) covering ICT incident severity categorization. Evidence period: Current validity period under DORA implementation. Required evidence: Incident logs dated within evidence period showing categorization per Article 36(1); Management review records confirming categorized assessments. Negative criterion: Absence of required incident severity logs. Missing evidence: Pending status when evidence not submitted. Alternatives: No valid substitutes; Article 36 mandates specific incident categorization.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies the positive criterion?
Incident logs dated within the evidence period explicitly showing categorization per Article 36(1), accompanied by management review records confirming the assessments. Synthetic fixture 'incident-categorization-1' demonstrates valid evidence.
When is the negative criterion triggered?
Absence of required severity classification documentation, even if incident records exist. Synthetic fixture 'incident-categorization-2' (list without severity categorization) represents failed evidence.
How are missing submissions handled?
Pending status applies when evidence isn't submitted despite documented incident management processes. Synthetic fixture 'incident-categorization-3' illustrates this unresolved state.
References
DORA: Critical provider oversight and supervisory readiness