The entity must document and implement an ICT-related incident policy that documents the incident management process of DORA Article 17; lists internal and external contacts involved in ICT operations security, including threat detection and monitoring, anomaly detection and vulnerability management; sets up technical, organisational and operational mechanisms supporting the process, including prompt anomaly detection under Article 23; keeps all evidence relating to incidents securely for no longer than needed, in proportion to the criticality of the affected functions and assets, in line with Article 8(2) of Delegated Regulation (EU) 2024/1772 (as corrected by the corrigendum of 15 May 2025) and any Union retention rule; and analyses significant or recurring incidents and patterns in their number and occurrence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.