DORA major ICT incident thresholds

The first gate is critical-service impact. Delegated Regulation (EU) 2024/1772 treats an incident as major only where it affects critical services and either the Article 9(5)(b) threshold is met through successful malicious unauthorised access not covered by Article 9(5)(a) that may result in data losses, or at least two other materiality thresholds are met.

Critical-service impact is not limited to total outages. The RTS treats an incident as affecting critical services if it affects ICT services or systems supporting critical or important functions, affects financial services provided by the financial entity that require authorisation, registration, or are supervised by competent authorities, or involves successful malicious unauthorised access to the financial entity's network and information systems.

Delegated Regulation (EU) 2024/1772 gives the main measurable thresholds. The incident team should record each criterion as met, not met, unknown, or estimated, and keep the data source for each answer.

Several criteria are not simple numeric tests. Reputational impact is met if the incident is reflected in the media, causes repetitive complaints from different clients or financial counterparts, leaves the entity unable or likely unable to meet regulatory requirements, or causes or is likely to cause the entity to lose clients or financial counterparts with a material impact on its business. Data-loss impact is assessed against availability, authenticity, integrity, and confidentiality.

Count criteria, not individual subconditions. Clients, financial counterparts and transactions form one Article 9(1) criterion. Operational example: an incident affecting a critical service that exceeds both the client-percentage and transaction-percentage thresholds has met one criterion, not two. If it also causes more than two hours of downtime for an ICT service supporting a critical or important function, the duration/downtime criterion supplies the second threshold for the Article 8(1)(b) route.

Recurring non-major incidents can become one major incident collectively. Delegated Regulation (EU) 2024/1772 applies this where the incidents occur at least twice within 6 months, have the same apparent root cause, and collectively satisfy the major-incident test.

Financial entities must assess recurring incidents monthly. The recurring-incident rule does not apply to microenterprises and to the financial entities listed in DORA Article 16(1), based on the RTS text.

Once the incident is classified as major, the reporting clock starts. Delegated Regulation (EU) 2025/301 requires the initial notification as early as possible, within 4 hours from major classification, and no later than 24 hours from awareness of the ICT-related incident. If classification as major happens later than 24 hours after awareness, the initial notification is due within 4 hours from that later classification.

The same RTS requires an intermediate report within 72 hours from the initial notification even if the incident status has not changed, an updated intermediate report without undue delay and whenever regular activities recover, and a final report no later than one month after the intermediate report or latest updated intermediate report. If a deadline cannot be met, the financial entity must inform the competent authority without undue delay, explain why, and do so no later than the missed deadline.