Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we decide whether an ICT incident is major under DORA?

9 decision pointsThe pack behind this answer: Regulatory Incident Notification & Reporting

Add to board memo

The short answer

Recommendation
Classify an incident as major when critical services are affected and either a malicious unauthorised access that may result in data losses has occurred or at least two other thresholds are met. Classify as soon as the facts allow and record the time, because the initial notification clock runs from it.
Reasoning
Critical services affected is always required; without it nothing is major. With it, the malicious access is enough alone, and any other threshold needs a second. The initial notification is due within 4 hours of classifying and no later than 24 hours after awareness. Where the incident is classified as major more than 24 hours after awareness, it is due within 4 hours of that classification. Figures you cannot yet count are estimated from comparable periods.
Considerations
  • The thresholds are the pack's summary of Delegated Regulation (EU) 2024/1772. Apply the Regulation's own text and your authority's guidance, and confirm your reading with counsel.
  • Incidents that are not major alone are one major incident where they occurred at least twice within 6 months, share an apparent root cause and together meet the test. This does not apply to microenterprises or to the entities DORA Article 16(1) lists.
  • If later facts show a reported incident never met the test, notify the reclassification as non-major on the template. Never stop reporting silently.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartAn ICT-related incident has been declaredStepFix the awareness time: the 24-hour limit runs from itDecisionDoes our applicability profile say DORA applies to us?OutcomeRecord DORA as Not applicable, citing the profileStepGather the figures; estimate what cannot yet be countedDecisionHas it affected critical services?DecisionWas there a malicious, unauthorised access that may lose data?DecisionHow many of the other six thresholds are met?DecisionCould a fact we do not yet know make it major?OutcomeRecord Not settled, with a revisit time before the doubt pointDecisionIs it confirmed that critical services are affected?StepClassify it as major, and record the time and criteria metStepSend the initial notification on the authority's templateDecisionDo later facts show it never met the major test?OutcomeNotify the reclassification as non-major; never stop silentlyOutcomeKeep reporting: intermediate, then final, each on its clockStepRecord Not reportable, with each criterion met or notDecisionAt the next update, has a fact changed?DecisionAt the monthly check, are same-cause incidents major together?OutcomeNot major: keep the record, revisit, and check recurrence monthly

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 20 steps.

  1. Start

    An ICT-related incident has been declared

    DORA's major-incident test comes from Delegated Regulation (EU) 2024/1772. It has one mandatory criterion, critical services, and a set of materiality thresholds. Every declared incident gets a recorded DORA decision, whether or not a report follows, within 4 hours of declaration in the pack's default.

    In the pack

  2. Step

    Fix the awareness time: the 24-hour limit runs from it

    Awareness is the time the incident was declared, or earlier where the record shows reasonable certainty earlier. The initial notification has two limits and the earlier wins: 4 hours from classifying the incident as major, and 24 hours from awareness. The 24-hour limit runs whether or not you have classified yet.

    In the pack

  3. Decision

    Does our applicability profile say DORA applies to us?

    DORA's reporting duties fall on financial entities. Settle that once, before any incident, in a profile your executive management approves, with the competent authority and its channel. If it is unclear, run the test anyway and settle scope with counsel.

    In the pack

    See also

  4. Outcome

    Record DORA as Not applicable, citing the profile

    One line in your notification log, with the profile as the reason, as the pack's example distributor does for every incident because it is not a financial entity. NIS2 and the GDPR are still tested on their own terms.

    In the pack

    See also

  5. Step

    Gather the figures; estimate what cannot yet be counted

    Put the facts in the one record every report is drafted from: services and functions affected, clients, counterparts and transactions, duration and downtime, Member States, data affected, costs. Figures that cannot yet be counted are estimated from comparable periods. Duration runs from when the incident occurred or was detected; downtime from when the service became unavailable.

    In the pack

  6. Decision

    Has it affected critical services?

    Always required. Yes when the incident affects ICT services or systems that support critical or important functions, or financial services that need authorisation, registration or supervision, or when it is a successful, malicious and unauthorised access to your network and information systems. Without this, nothing is major however many thresholds are met.

    In the pack

  7. Decision

    Was there a malicious, unauthorised access that may lose data?

    A successful, malicious and unauthorised access to network and information systems that may result in data losses. With critical services affected, this alone makes the incident major. If you cannot yet tell, carry it as unknown and count the other thresholds.

    In the pack

  8. Decision

    How many of the other six thresholds are met?

    Clients, counterparts or transactions (for example more than 10% of the service's clients, or more than 100,000); reputational impact; duration over 24 hours, or a service supporting critical functions down over 2 hours; impact in two or more Member States; data losses that harm business objectives or compliance; costs and losses over 100,000 euro. Data losses alone is one threshold, not enough.

    In the pack

  9. Decision

    Could a fact we do not yet know make it major?

    If a missing figure or an unconfirmed access could still tip the count, the decision cannot be settled yet. Do not record Not reportable to fill the gap. If no unknown could change the result, it is not major on the facts known.

    In the pack

  10. Outcome

    Record Not settled, with a revisit time before the doubt point

    Record the missing fact, who is finding it out, and when you will decide again. If it is still not settled 6 hours before the initial notification deadline, the pack's default, treat it as major and report on the facts known. Brief whoever submits reports now.

    In the pack

    See also

  11. Decision

    Is it confirmed that critical services are affected?

    Two thresholds make the incident major only with critical services affected. If that is still unknown, the decision turns on it and is Not settled, not Reportable. A malicious unauthorised access counts as affecting critical services by itself, so that route does not need this check.

    In the pack

  12. Step

    Classify it as major, and record the time and criteria met

    The executive incident lead decides to report and records which criteria were met and on what facts. The classification time matters: the 4-hour limit for the initial notification runs from it. If you classify more than 24 hours after awareness, the notification is due 4 hours after classification.

    In the pack

  13. Step

    Send the initial notification on the authority's template

    Use the template of Implementing Regulation (EU) 2025/302 through your competent authority's channel. An intermediate report follows within 72 hours of the initial notification and again when regular activities are recovered; the final report within one month of the latest intermediate report. Tell clients whose financial interests are affected without undue delay.

    In the pack

    See also

  14. Decision

    Do later facts show it never met the major test?

    Ask at every update. New facts can show the first classification was wrong. A change from major to non-major is reported to the authority on the template; it is never made by simply stopping the reports.

    In the pack

  15. Outcome

    Notify the reclassification as non-major; never stop silently

    Notify the authority on the template that the incident is reclassified as non-major, with the facts that changed. Record it as a new decision line, Not reportable, that replaces the Reportable one. The first line stays in the log.

    In the pack

  16. Outcome

    Keep reporting: intermediate, then final, each on its clock

    Each submission sets the next due time in the log and in the calendars of the drafter and whoever submits. The final report's clock restarts with each intermediate report. If a time limit cannot be met, tell the authority before it passes and say why.

    In the pack

  17. Step

    Record Not reportable, with each criterion met or not

    Name the criteria met and not met, and the facts behind each. If the incident is Severity 1 or 2 when the decision is recorded, the executive incident lead decides not to report; at Severity 3 or 4 the incident manager may record it.

    In the pack

  18. Decision

    At the next update, has a fact changed?

    A decision not to report is revisited at every incident update and at once when a fact changes, and the result is recorded even when unchanged. A new figure can meet a threshold days later; classify then, and the 4-hour limit runs from that classification.

    In the pack

  19. Decision

    At the monthly check, are same-cause incidents major together?

    Incidents that are not major one by one are one major incident where they occurred at least twice within 6 months, share the same apparent root cause, and together meet the test. Check every month. This does not apply to microenterprises or to the financial entities DORA Article 16(1) lists.

    In the pack

  20. Outcome

    Not major: keep the record, revisit, and check recurrence monthly

    The decision line, the facts as they stood and every revisit are your answer if the authority later asks why it was not told. Keep it in view at each monthly recurrence check, because incidents with the same root cause within 6 months are tested together.

    In the pack

Practical checklist

  1. Confirm from the applicability profile that DORA applies, and which authority and channel receive reports.
  2. Fix the awareness time: the 24-hour limit runs from it whether or not you have classified.
  3. Gather the figures in one fact base, estimating what cannot yet be counted from comparable periods.
  4. Test critical services first, then malicious access, then count the other thresholds.
  5. Record Not settled with a revisit time where an unknown could tip the result, and treat it as major 6 hours before the deadline.
  6. Record the classification time and the criteria met, and send the initial notification on the authority's template.
  7. Revisit every decision at each update, and check monthly for same-cause incidents that are major together.

Evidence to have ready

  • The classification time beside the awareness time, and the initial notification's submission time.
  • The decision line: each criterion met or not, the facts and estimates behind it, who decided and when.
  • The fact base as it stood at the decision, and every revisit with its result.
  • The monthly recurrence checks, and any reclassification notice with the facts that changed.

Assumptions

  • You are a financial entity under DORA, and a profile approved before any incident says so and names your financial competent authority and its reporting channel.
  • You know which of your functions are critical or important and which ICT services support them, because the first test depends on it.
  • The thresholds here are the pack's summary of Delegated Regulation (EU) 2024/1772. The Regulation's own text, and your authority's guidance, are what you apply; confirm your reading with counsel.

Not covered here