Only major incidents are reportable
Entities must classify ICT-related incidents and determine their impact against criteria set in the Regulation: number of clients and financial counterparts affected, duration and service downtime, geographical spread, data losses, criticality of the services affected, and economic impact. Only an incident classified as major triggers mandatory reporting.
Why it is like this
Reporting everything would bury supervisors and teach firms to report nothing carefully. A classification step forces the judgement to be made and recorded before the clock question even arises.
Not to be confused with
A severity scale you already have. The criteria are set in EU law and refined in regulatory technical standards with thresholds — an internal P1/P2 scheme is not a substitute, and mapping the two is work.
In practice
There is a parallel category: significant cyber threats, which may be reported voluntarily even though no incident has occurred.
Source: Regulation (EU) 2022/2554 (DORA) — Art. 18. Read on .
Say it back Check yourself
Name four of the criteria DORA uses to classify an ICT-related incident.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Number of clients or financial counterparts affected, and whether they are material
- Duration of the incident and service downtime
- Geographical spread, in particular across other Member States
- Data losses — availability, authenticity, integrity or confidentiality
- Criticality of the services affected
- Economic impact, both direct and indirect
The thresholds live in the regulatory technical standards; the criteria themselves are in Article 18 and are worth knowing by heart.