Article 10Detection
1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.
All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with Article 25.
2. The detection mechanisms referred to in paragraph 1 shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes, including automatic alert mechanisms for relevant staff in charge of ICT-related incident response.
3. Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.
4. Data reporting service providers shall, in addition, have in place systems that can effectively check trade reports for completeness, identify omissions and obvious errors, and request re-transmission of those reports.
DORA, the European Union regulation on digital operational resilience, Article 10
Detection is the front end of the incident management process in Article 17. Entities must have mechanisms to detect anomalous activities promptly, including network performance issues and ICT-related incidents, in line with Article 17, and to identify potential material single points of failure. All of these mechanisms must be tested regularly under Article 25.
The mechanisms must provide several layers of control, define alert thresholds and criteria that trigger incident response, and include automatic alerts to the staff responsible for response. Entities must also devote enough resources and capability to monitoring user activity, ICT anomalies and incidents, in particular cyber-attacks.
Data reporting service providers have an extra duty: systems that check trade reports for completeness, spot omissions and obvious errors, and request retransmission.
The technical standards under Article 15 add detail on the detection mechanisms and on the criteria that trigger incident response.
What is in the packs for this
From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
Requirement Library rows RQ-15: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
Readiness items RM-05 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Risk Management Framework Document TemplateWord
Statement FW-27 on detection.
DORA Documentation & Evidence ChecklistExcel
Evidence records EV-11: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.