DORA Major ICT Incident Reporting

Under the incident-classification RTS, an incident is a major incident for DORA Article 19 reporting when it affects critical services and either meets the data-loss materiality threshold for successful malicious unauthorised access that may result in data losses, or meets at least two other materiality thresholds.

The classification file should separately record every threshold assessed, including why a threshold was not met. That matters because recurring non-major incidents can collectively become one major incident when they occur at least twice within six months, have the same apparent root cause, and collectively meet the major-incident criteria. Financial entities must assess recurring incidents monthly, except where the RTS exclusion for microenterprises and Article 16(1) entities applies.

The initial notification is the fast supervisory alert. It should contain the shared general fields required across all three reporting stages, then the specific facts available at classification time.

The reporting-content RTS requires general information such as the type of submission, entity name, LEI code, submitting entity, aggregated entities where applicable, competent-authority contact details, parent undertaking where applicable, and reporting currency where monetary impact exists. The initial notification then adds the entity's incident reference code, detection and classification timestamps, incident description, classification criteria, impacted Member States, discovery method, available origin information, business-continuity activation, reclassification information where applicable, and other relevant information.

The intermediate report is where the incident record becomes operationally useful: it updates the competent authority on occurrence time, recovery status, fulfilled classification criteria, incident type, threat actor techniques where applicable, affected business processes and infrastructure, client financial-interest impact, other authority reporting, recovery measures, and indicators of compromise where applicable.

The final report closes the supervisory file once root cause analysis is complete and actual impact figures can replace estimates. It must cover root causes, resolution and root-cause remediation dates and times, incident resolution, resolution-authority information where applicable, direct and indirect costs and losses, recoveries, and recurring-incident information where applicable.

DORA reporting goes to the relevant competent authority. Where a financial entity is supervised by more than one national competent authority under DORA Article 46, Member States must designate a single relevant competent authority for Article 19 reporting. Significant credit institutions report to the relevant national competent authority, which immediately transmits the report to the ECB.

After receiving the initial notification and each report, the competent authority provides incident details to the relevant ESA, the ECB for specified financial entities, NIS2 competent authorities, single points of contact or CSIRTs, resolution authorities where the incident concerns critical functions, and other public authorities under national law. The ESAs and ECB then assess whether the incident is relevant for competent authorities in other Member States.

DORA treats significant cyber threat notifications differently from major incident reports. A financial entity may notify a significant cyber threat voluntarily when it considers the threat relevant to the financial system, service users, or clients. The classification RTS treats a cyber threat as significant where it could affect critical or important functions or other relevant parties, has a high probability of materialisation, and could meet specified major-incident criteria or thresholds if it materialised.

The voluntary notification content is narrower than major-incident reporting. It covers general entity information, detection timestamps, threat description, potential impact, classification criteria that would have triggered a major report if the threat materialised, threat status, actions taken to prevent materialisation, and notification to other financial entities or authorities.

A useful DORA evidence file lets a reviewer reconstruct the classification and every report without reopening raw incident tooling. Keep the incident chronology, classification worksheet, evidence for each threshold, the submitted template versions, competent-authority acknowledgements or guidance, client communications, and the final root-cause and impact record together.

The evidence should distinguish estimates from actual values because the reporting template permits estimates in initial and intermediate stages, while the final report is expected once root cause analysis is complete and actual impact figures are available to replace estimates.