DORA
A major ICT incident, classified and reported on time.
Eurus counts a person's answers against the criteria of Delegated Regulation (EU) 2024/1772 and says whether the incident is major, which thresholds are met and what is still unknown. A major incident starts the three reporting clocks.
When an incident is major
Article 18 of DORA asks financial entities to classify ICT-related incidents. Article 8(1) of Delegated Regulation (EU) 2024/1772 sets the test.
Critical services first
The incident has affected ICT services that support critical or important functions, financial services that are authorised or supervised, or it is a successful, malicious and unauthorised access to the network and information systems (Article 6).
Then malicious access with data at risk
A successful, malicious and unauthorised access that may result in data losses makes it major (Article 9(5)(b)).
Or two other thresholds
Otherwise it takes two or more of the other thresholds: clients, financial counterparts and transactions affected; reputational impact; duration and service downtime; impact in two or more Member States; data losses; and costs and losses above €100,000 (Article 9).
Recurring incidents
Incidents that recur with the same apparent root cause, each below the bar, can together be one major incident (Article 8(2)).
The reports and their times
Article 19 of DORA asks for three reports to the competent authority. Article 5 of Delegated Regulation (EU) 2025/301 sets their times.
Initial notification
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Intermediate report
Within 72 hours of the initial notification.
Final report
Within one month of the latest intermediate report.
Clients
Where the incident affects clients' financial interests, the entity tells them without undue delay, with the measures taken (Article 19(3)).
The forms
Delegated Regulation (EU) 2025/301 sets what each report holds, and Implementing Regulation (EU) 2025/302 sets the forms.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyHow Eurus handles it
The classification is a person's answers, counted against the Regulation's own tests. The clocks follow from it.
The criteria as questions
Each criterion of Articles 6 and 9 is a question with its article. An answer not yet known stays unknown.
Major, or undecided
The result names the thresholds met and what is still unknown. An incident with open answers that could make it major stays undecided.
The clocks start at classification
A major result classifies the incident then: the initial notification is due 4 hours on, and never later than 24 hours from awareness.
Each report from the one before
The intermediate report runs from the initial notification's real submission, and the final report from the latest intermediate report's. The weekend and holiday relief of Article 5 is left out, which keeps the stricter dates.
Closed below the bar
An incident never classified and assessed as not major has its DORA reports closed as not needed, with the reason kept on the record.
Beside GDPR
A personal data breach in the same incident starts GDPR's 72 hours from awareness, on its own clock.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.