How do we complete DORA's initial notification, intermediate report and final report on a major incident?

Start

A major ICT incident has been classified and reports are now due

DORA asks for three submissions to the competent authority: an initial notification, an intermediate report and a final report. The Regulation gives their purpose and leaves the content and time limits to a Commission Delegated Regulation, and the templates to an Implementing Regulation. This question covers what each report holds and how to get it out when facts are thin.

• Then: Has the incident been classified as major under DORA?

Decision

Has the incident been classified as major under DORA?

Reports are due for a major incident only. If the classification is not settled, settle it first, because the first time limit runs from classification. Not known takes the no branch to the classification question.

• Yes: Open one fact base and fix the awareness and classification times
• No, or not known: Classify the incident first, then come back

Outcome

Classify the incident first, then come back

Apply the classification test, and if the facts are missing use the question on deciding when the facts are unclear. Record the time of the decision; the first report runs from it. A decision not to report is also recorded, with reasons.

Step

Open one fact base and fix the awareness and classification times

All three reports draw on the same facts, so keep one fact base for the incident and update it as you learn. Write down when you became aware, when you classified it as major and who decided. Every report quotes these times.

• Then: Set the due time for each report from the Delegated Regulation

Step

Set the due time for each report from the Delegated Regulation

The time limits are not in DORA. They are in the Delegated Regulation on content and time limits: the initial notification runs from classification, with an outer limit from awareness unless you classify the incident after that limit has passed, when the classification limit applies alone; the intermediate report runs from the initial notification, and the final report from the latest intermediate report, so each update moves it. Take the figures from your pack timeline or the current text, write all three due times on the case, and check for amendments.

• Then: Does a third party submit the reports for us?

Decision

Does a third party submit the reports for us?

DORA lets a firm outsource its reporting, but it stays fully responsible. The authority must be told of the arrangement, with the third party's name, contact details and identification code, before the first report. Not known: check the contract.

• Yes, or not known: Check the contract, the notice to the authority and the access
• No: Can a named signatory submit through the authority's channel now?

Step

Check the contract, the notice to the authority and the access

The contract should name the third party as reporter, set the times it must meet and give it the fact base as its only source. The executive incident lead still decides whether to report. A provider serving several firms may send one combined report only in the narrow cases the Implementing Regulation allows.

• Then: Can a named signatory submit through the authority's channel now?

Decision

Can a named signatory submit through the authority's channel now?

Reports go through secure electronic channels that the authority provides. Test who can sign in, including out of hours. If a technical impossibility stops you using the template for the initial notification, DORA says to tell the authority by other means.

• Yes: Complete the initial notification with what you know
• No, or not known: Notify the authority by the alternative means it has given

Step

Notify the authority by the alternative means it has given

Use the fallback route your authority names, such as a phone number or an email address, and log that you did. Say that the template could not be used, and send the template through the channel afterwards if your authority asks.

• Then: Complete the initial notification with what you know

Step

Complete the initial notification with what you know

It holds general information about the entity and who submits, then the incident reference, the date and time of detection and classification, a description, the criteria that made it major, the Member States affected, how it was discovered, the origin where available, whether a continuity plan was activated, and any reclassification from major to non-major. Write what you know. Mark estimates as estimates, and do not wait for the cause.

• Then: Can the initial notification go in before the due time?

Decision

Can the initial notification go in before the due time?

If you will miss a limit on any of the three reports, the technical standard requires you to tell the authority without undue delay and no later than the limit, with the reasons for the delay. Silence is the worse choice. A weekend or holiday allowance exists for some firms and not others, so check which applies to you.

• Yes: Approve, submit and log it, then diary the next report
• No, or not known: Tell the authority before the limit, with the reasons

Step

Tell the authority before the limit, with the reasons

Send a short message by the channel or the alternative route that names the incident, the report that will be late, why, and when it will follow. Log it. Then send the report as soon as you can. The same applies to a late intermediate or final report.

• Then: Approve, submit and log it, then diary the next report

Step

Approve, submit and log it, then diary the next report

The executive incident lead decides whether to report, a second person checks the text against the fact base when time allows, and a named signatory submits. Log the time, the authority's reference and the next due time. The reference goes into later reports.

• Then: Does the incident affect clients' financial interests?

Decision

Does the incident affect clients' financial interests?

DORA separately requires the firm to inform affected clients without undue delay, as soon as it becomes aware, and to tell them what has been done to limit the harm. This is a duty to clients and is in addition to the report to the authority. Start this as soon as you are aware; it does not wait for the report to the authority.

• Yes, or not known: Tell the affected clients, with the measures taken
• No: Send intermediate reports and updates, approved and logged as before

Step

Tell the affected clients, with the measures taken

Use the approved customer notice. It says that a major incident has affected their financial interests and what you are doing about it. Do not wait for the intermediate report, and do not speculate about cause.

• Then: Send intermediate reports and updates, approved and logged as before

Step

Send intermediate reports and updates, approved and logged as before

It adds the authority's reference, the times of occurrence and recovery, how the criteria were met, the type of incident, threats and techniques, areas and infrastructure affected, effect on clients, other authorities told, temporary measures and indicators of compromise. The technical standard sets a limit even if little has changed. Send an updated report on a significant change, on request, and when regular activities are recovered. Apply the late-notice rule to each, and approve, submit and log it as before.

• Then: Do later facts show it never met the major test?

Decision

Do later facts show it never met the major test?

If it never met the thresholds at any time, notify the reclassification to non-major on the template. Never just stop reporting. Not known keeps you reporting until the facts settle it.

• Yes: Notify the reclassification as non-major on the template
• No, or not known: Is the root cause analysis done, with actual impact figures?

Outcome

Notify the reclassification as non-major on the template

Use the reclassification field in the template, say why it never met the test, and keep the records. Review whether your classification process needs a correction. The incident record stays open for your own post-incident review.

Decision

Is the root cause analysis done, with actual impact figures?

The final report is due when the root cause analysis is complete, whether or not every mitigation is in, and when actual figures replace estimates. If either is missing, send another intermediate report and keep working. The final report keeps its own limit, counted from your latest intermediate report, so tell the authority in advance if the analysis will not be done by then.

• Yes: Send the final report: causes, resolution, costs and recurrence
• No, or not known: Send intermediate reports and updates, approved and logged as before (back to an earlier step)

Step

Send the final report: causes, resolution, costs and recurrence

It holds the root causes, when the incident was resolved and the causes addressed, how it was resolved, information relevant to resolution authorities where it applies, direct and indirect costs and losses with recoveries, and any recurring incidents. If regular activities have recovered or the root cause analysis is done, you may send two or all of the submissions together, provided each limit is met. Apply the late-notice rule, and approve, submit and log it as before.

• Then: All three reports submitted, logged and consistent with one fact base

Outcome

All three reports submitted, logged and consistent with one fact base

Keep the reports, the references, the log and the fact base. Do not say the authority has accepted the reports as complete unless it has told you so, and do not say you complied with the time limits unless the log shows it.