Article 17ICT-related incident management process
1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.
2. Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.
3. The ICT-related incident management process referred to in paragraph 1 shall:
(a) put in place early warning indicators;
(b) establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);
(c) assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;
(d) set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;
(e) ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;
(f) establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.
DORA, the European Union regulation on digital operational resilience, Article 17
The incident management process, defined, established and implemented to detect, manage and notify ICT-related incidents. All ICT-related incidents and significant cyber threats must be recorded, with procedures ensuring consistent monitoring, handling and follow-up so that root causes are identified, documented and addressed.
The process must put in place early warning indicators; establish procedures to identify, track, log, categorise and classify incidents by priority and severity and by criticality of the services affected, using the Article 18(1) criteria; assign roles and responsibilities for different incident types and scenarios; set out plans for communication to staff, external stakeholders and media and for client notification, internal escalation including ICT-related customer complaints, and information to counterparts; ensure that at least major incidents are reported to relevant senior management and that the management body is informed of them with impact, response and additional controls; and establish response procedures to mitigate impact and restore service.
Note the recording duty in paragraph 2: it covers all ICT-related incidents and significant cyber threats, not only major ones, so what must be recorded is wider than what must be reported under Article 19.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-27: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items IM-01 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
Security Incident Management PolicyWord
in Security Incident Management
Sets the whole incident management policy as part of the ICT-related incident management process, with a regulated-entity note.
in Security Incident Management
Sets roles, communications and escalation to the management body, with a regulated-entity note.
Incident Triage & First-Hour Assessment ProcedureWord
in Security Incident Management
Covers logging, classifying and escalating incidents, with a regulated-entity note.
Incident Case & Action LogExcel
in Security Incident Management
The Cases and root cause columns record each incident with its root causes identified and addressed.
Post-Incident Review TemplateWord
in Security Incident Management
Part F records the root causes, identified, documented and addressed.
Regulatory Notification LogExcel
in Regulatory Incident Notification & Reporting
The Decisions sheet records every ICT-related incident with its decision.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.