DORA major ICT incident thresholds

The first gate is critical-service impact. Delegated Regulation (EU) 2024/1772 treats an incident as major only where it affects critical services and either a successful malicious unauthorised access threshold linked to possible data loss is met, or at least two other materiality thresholds are met.

Critical-service impact is not limited to total outages. The RTS treats an incident as affecting critical services if it affects ICT services or systems supporting critical or important functions, affects financial services whose provision requires authorisation, or involves successful malicious unauthorised access to network and information systems supporting critical or important functions.

Delegated Regulation (EU) 2024/1772 gives the main measurable thresholds. The incident team should record each criterion as met, not met, unknown, or estimated, and keep the data source for each answer.

Several criteria are not simple numeric tests. Reputational impact is met if the incident is reflected in the media, causes repetitive complaints from different clients or financial counterparts, leaves the entity unable or likely unable to meet regulatory requirements, or is likely to cause material client or counterparty loss. Data-loss impact is assessed against availability, authenticity, integrity, and confidentiality.

Recurring non-major incidents can become one major incident collectively. Delegated Regulation (EU) 2024/1772 applies this where the incidents occur at least twice within 6 months, have the same apparent root cause, and collectively satisfy the major-incident test.

Financial entities must assess recurring incidents monthly. The recurring-incident rule does not apply to microenterprises and to the financial entities listed in DORA Article 16(1), based on the RTS text.

Once the incident is classified as major, the reporting clock starts. Delegated Regulation (EU) 2025/301 requires the initial notification as early as possible, within 4 hours from major classification, and no later than 24 hours from awareness of the ICT-related incident. If classification as major happens later than 24 hours after awareness, the initial notification is due within 4 hours from that later classification.

The same RTS requires an intermediate report within 72 hours from the initial notification even if the incident status has not changed, an updated intermediate report without undue delay and whenever regular activities recover, and a final report no later than one month after the intermediate report or latest updated intermediate report. If a deadline cannot be met, the financial entity must inform the competent authority without undue delay, explain why, and do so no later than the missed deadline.