/incident-reporting

description: Major ICT-related incident reporting process and requirements under DORA

DORA Incident Reporting

Provides comprehensive guidance on DORA's incident management and reporting requirements for major ICT-related incidents.

Arguments

• `$1` - Incident severity (required: major, non-major, cyber-threat)
• `$2` - Reporting stage (optional: initial, intermediate, final, update)

Incident Reporting Overview

**Legal Basis**: Articles 17-23 of DORA **Requirement**: Mandatory reporting of major incidents to national competent authorities **Timeline**: Strict deadlines (4 hours, 72 hours, 1 month) **Penalties**: Significant fines for non-compliance

Incident Classification

Major Incident Criteria (Article 18)

An ICT-related incident is classified as **major** if it meets one or more of these criteria:

1. Impact on Financial Services

**Threshold Indicators**:

• Critical or important functions affected
• Services unavailable or degraded
• Transaction processing disrupted
• Client access to accounts/services blocked
• Payment systems affected

**Examples**:

• Online banking unavailable for >2 hours
• Payment processing system down
• Trading platform outage during market hours
• ATM network failure affecting multiple locations

2. Client/Counterparty Impact

**Threshold Indicators**:

• Large number of clients affected (>10,000 for large entities, proportionate for smaller)
• High-value counterparties impacted
• Multiple member states affected
• Impact duration exceeds tolerance levels

**Examples**:

• Widespread account access issues
• Failed bulk payments affecting thousands
• Trading disruptions affecting multiple clients
• Data breach exposing client information

3. Duration of Impact

**Threshold Indicators**:

• Service unavailable exceeding RTO (Recovery Time Objective)
• Prolonged degradation of critical services
• Extended recovery time
• Multiple business days affected

**Typical Thresholds** (entity-specific):

• Critical services: >2-4 hours
• Important services: >4-8 hours
• Supporting services: >24 hours

4. Geographical Spread

**Threshold Indicators**:

• Incident affects operations in multiple EU member states
• Cross-border service disruption
• International clients impacted
• Widespread system failure

5. Data Loss or Corruption

**Threshold Indicators**:

• Loss of critical data affecting service delivery
• Data corruption preventing transaction processing
• Integrity of financial records compromised
• Personal data breach requiring GDPR notification

**Examples**:

• Transaction database corruption
• Customer account data loss
• Financial records integrity issues
• Backup systems compromised

6. Reputational Impact

**Threshold Indicators**:

• Significant media coverage
• Public confidence affected
• Regulatory scrutiny triggered
• Market impact on share price

**Examples**:

• Major cybersecurity breach publicized
• Extended service outage reported in media
• Data breach affecting thousands of clients
• Ransomware attack with public demands

7. Economic Impact

**Threshold Indicators**:

• Direct financial losses exceeding materiality thresholds
• Operational costs of incident response
• Regulatory fines or penalties
• Client compensation required

**Typical Thresholds**:

• Large institutions: >EUR 100,000
• Medium institutions: >EUR 50,000
• Small institutions: >EUR 10,000
• *(Proportionate to entity size and complexity)*

Non-Major Incidents

**Characteristics**:

• Limited impact on services
• Contained to single function/system
• Quick resolution (within tolerance)
• Minimal client impact
• No data loss or corruption
• No reputational damage

**Reporting**:

• Internal tracking and documentation required
• No mandatory reporting to authorities
• May aggregate for trend analysis
• Report if incident escalates to major

Cyber Threats (Article 20)

**Definition**:

• Potential cyber attack identified
• Vulnerability discovered that could be exploited
• Threat intelligence indicating targeting
• Reconnaissance or probing detected

**Reporting**:

• **Voluntary** notification to authorities
• Can share with other financial entities
• Liability protection for good faith sharing
• Helps collective defense

Incident Reporting Timeline

Initial Notification (4 Hours)

**Deadline**: Within 4 hours of detection and classification as major incident

**Required Information**:

• Date and time of incident detection
• Indication that incident is classified as major
• Preliminary description of incident
• Affected systems or services
• Initial assessment of impact
• Status of incident (ongoing, contained, resolved)

**Submission Method**:

• Via single point of contact to NCA
• Using standardized template (when available)
• Electronic submission preferred

**Key Point**: This is notification of awareness, not full analysis. Speed is critical.

Intermediate Report (72 Hours)

**Deadline**: Within 72 hours of initial notification

**Required Information**:

• Updated incident classification and justification
• Actual number of clients/users affected
• Actual duration of impact to date
• Geographical scope of incident
• Root cause analysis (preliminary or final)
• Technical details of incident:
• Attack vectors (if applicable)
• Vulnerabilities exploited
• Systems/services compromised
• Data affected
• Mitigation actions taken
• Recovery actions initiated
• Expected recovery timeline
• Whether incident is ongoing
• Estimated further impact

**Analysis Required**:

• More detailed impact assessment
• Initial root cause if identified
• Evidence of mitigation effectiveness

Final Report (1 Month)

**Deadline**: Within 1 month after initial notification (may be extended in complex cases)

**Required Information**:

• **Comprehensive Incident Description**:
• Full timeline of events
• Complete impact assessment
• Final client/service impact numbers
• Total duration of incident

-