Article 17ICT-related incident management process

What it says

1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.

2. Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.

3. The ICT-related incident management process referred to in paragraph 1 shall:

(a) put in place early warning indicators;

(b) establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);

(c) assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;

(d) set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;

(e) ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;

(f) establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.

DORA, the European Union regulation on digital operational resilience, Article 17

What it means in practice

What is in the packs for this

Each one helps with this requirement.

• XLSExcel

  DORA Article-to-Control Mapping Library

  in DORA ICT Risk & Resilience ReadinessRequirement Library rows RQ-27: An incident management process. Each gives the provision in plain words, what to show and the documents that help.
• XLSExcel

  DORA Readiness Self-Assessment

  in DORA ICT Risk & Resilience ReadinessReadiness items IM-01: Incidents managed, logged and classified. Each rates how ready the entity is, with the evidence and the gap.
• DOCWord

  Security Incident Management Policy

  in Security Incident ManagementSets the whole incident management policy as part of the ICT-related incident management process, with a regulated-entity note.
• DOCWord

  Incident Response Plan

  in Security Incident ManagementSets roles, communications and escalation to the management body, with a regulated-entity note.
• DOCWord

  Incident Triage & First-Hour Assessment Procedure

  in Security Incident ManagementCovers logging, classifying and escalating incidents, with a regulated-entity note.
• XLSExcel

  Incident Case & Action Log

  in Security Incident ManagementThe Cases and root cause columns record each incident with its root causes identified and addressed.
• DOCWord

  Post-Incident Review Template

  in Security Incident ManagementPart F records the root causes, identified, documented and addressed.
• XLSExcel

  Regulatory Notification Log

  in Regulatory Incident Notification & ReportingThe Decisions sheet records every ICT-related incident with its decision.