# DORA SNI Documentation & Implementation Suite v1.1

Release date: 23 July 2026

## Purpose

This controlled remediation release corrects the missing D06 annexes identified in version 1.0 and reconciles every affected requirement-to-deliverable reference across the suite.

## New and replaced files

- Replaced `D06_ICT_Incident_Management_and_DORA_Reporting_Procedure.docx` with a 35-page version containing Annexes A–E.
- Added `D06_Incident_Classification_and_Regulatory_Reporting_Workbook.xlsx`.
- Added `00_D06_Annex_Remediation_Log.xlsx`.
- Replaced the master traceability matrix, D14 evidence register, and architecture report in Word and PDF.
- Updated this README and the complete-suite package.

## Remediation outcome

All 206 broken D06 references have controlled outcomes:

- 95 records map to Annex A — ICT Incident Classification and Escalation Tool.
- 85 records map to Annex B — Regulatory Reporting Pack and Submission Runbook.
- 1 conditional payment-services record maps to Annex C.
- 19 authority-only records map primarily to R00 Appendix A, with D06 Annex D retained only as supporting regulatory context.
- 6 optional information-sharing records map to Annex E.

The 54 references to D08 Appendix C — TLPT Activation Checklist are separate, valid references and remain unchanged.

## Legal baseline used for D06

- Regulation (EU) 2022/2554 (DORA).
- Commission Delegated Regulation (EU) 2024/1772 on classification criteria and materiality thresholds.
- Commission Delegated Regulation (EU) 2025/301 on reporting content and time limits.
- Commission Implementing Regulation (EU) 2025/302 on reporting forms, templates and procedures.
- Icelandic Act No. 78/2025 and current Central Bank of Iceland DORA guidance.

## Use conditions

This remains a reusable template suite. It does not establish that a firm has implemented the controls, suffered a reportable incident or made a regulatory submission. Firm-specific facts, current regulator-issued forms, the competent submission channel, technical evidence and responsible-person approvals must be confirmed before operational use.