DORA · pillar 3 of 5
Incidents — classify, then report three times
Only major incidents are reportable, and the deadlines are not in the Regulation.
- 7 Only major incidents are reportable Entities must classify ICT-related incidents and determine their impact against criteria set in the Regulation: number…
- 8 The clocks are not in the Regulation Article 19 requires three submissions for a major incident — an initial notification, an intermediate report and a…
- 9 Clients, and threats you were not asked about Two obligations sit beside the supervisory report. Where a major incident has or may have an impact on clients'…
Start this pillar See the whole map
Read against Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.