Dora Ict Incident Reporting (Financial Sector)
Objective
Comply with DORA 4-hour notification requirement.
Control / requirement
Incident classification + notification workflow + SLA monitoring.
Business impact
Failure to notify National Competent Authority within 4 hours of a major ICT incident triggers fines and regulatory scrutiny.
Validation approach
Test ID: D8-CTL-04-VTS-001 Test Type: Manual (tabletop) Test Design: Simulate major AI security incident; verify notification workflow to NCA within 4 hours Execution Steps: 1. Classify incident per DORA taxonomy 2. Execute notification workflow 3. Measure time 4. Verify required fields Pass Criteria: notification_sent_within_4h = True; incident_classification_applied = True; required_fields_complete = True Independent Verification: Auditor observes tabletop and reviews workflow.
Expected evidence
Not separately specified in the available source.
Mapping and source
Not separately specified in the available source.
Implementation guidance
Translate the requirement into system-specific procedures, responsible roles, technical configurations and review conditions. Retain evidence showing both design and operating performance. Where the source provides no separate implementation instruction, do not infer that a single technical mechanism is sufficient.
Assessment considerations
- Confirm scope and applicability.
- Inspect control design and responsible ownership.
- Test representative operation and adverse conditions where appropriate.
- Evaluate evidence provenance, completeness and contradictory evidence.
- Record limitations and notably absent outcomes.