# DORA SNI Documentation & Implementation Suite v1.1

This is a reusable, conservative but proportionate template suite for a small and non-interconnected investment firm using the DORA Article 16 simplified ICT risk-management framework.

Start with:

1. `DORA_SNI_Architecture_and_Traceability_Report.pdf` for the architecture, assumptions, readiness gates and complete legal cross-reference.
2. `02_Registers_and_Workpapers/00_Master_Requirements_and_Traceability.xlsx` for the sortable 612-record requirements schedule.
3. `02_Registers_and_Workpapers/00_Client_Fact_Finding_Questionnaire.xlsx` to confirm entity-specific assumptions.
4. D01, D03 and D04 to fix governance, risk methodology, critical functions, assets and dependencies before tailoring the remaining suite.
5. `02_Registers_and_Workpapers/D06_Incident_Classification_and_Regulatory_Reporting_Workbook.xlsx` when classifying, escalating or reporting an ICT-related incident.

## Version 1.1 incident-management release

Version 1.1 corrects the missing D06 annexes and all 206 affected traceability records:

- Annex A — ICT Incident Classification and Escalation Tool — mandatory operational tool.
- Annex B — Regulatory Reporting Pack and Submission Runbook — mandatory when a reportable major ICT-related incident occurs.
- Annex C — Payment-Service Incident Interface — conditional on the firm providing relevant payment services.
- Annex D — Regulatory Interface and Legal Context — explanatory context only; authority-only provisions are mapped to the architecture report.
- Annex E — Optional Information-Sharing Decision Record — optional and activated only if participation is contemplated.

The new D06 operational workbook provides usable classification, reassessment, reporting-field, submission, follow-up, payment-interface, regulatory-context and information-sharing records. `00_D06_Annex_Remediation_Log.xlsx` documents the outcome for every affected requirement.

## Folder structure

- `01_Controlled_Documents`: D01, D02, D05, D06, D08, D09, D11, D12 and D13 Word templates.
- `02_Registers_and_Workpapers`: D03, D04, D07, D10 and D14 registers plus supporting workbooks for incident classification and reporting, continuity, testing, providers, training, assurance, implementation and fact-finding.
- `03_Training_Materials`: editable management-body and staff training deck.

## Important use conditions

- Confirm SNI status and separately assess DORA microenterprise status.
- Tailor every yellow/bracketed field and remove drafting notes before approval.
- Do not claim that a control is implemented merely because a document is approved.
- Do not populate controls, risks, incidents, providers, tests, audit results, RTO/RPO values or evidence with invented facts.
- Obtain business-owner, technical, legal and independent-assurance validation as identified in the suite.
- Revalidate legal references, Central Bank channels and current forms before client use or regulatory submission.
- Confirm the current Central Bank submission channel and prescribed forms when an incident is reportable; the D06 pack is an internal working tool and does not replace a regulator-issued submission form.
- TLPT material is conditional and must be activated only if the firm is designated or otherwise required to perform TLPT.

The suite is an implementation architecture and drafting package, not a legal opinion, compliance certificate or substitute for firm-specific implementation and testing.
