Running ICT incidents under DORA beyond the reporting deadlines: telling clients, outsourcing reporting, estimating annual costs and losses, handling recurring incidents and post-incident reviews.
When and how DORA requires clients to be told about incidents: notification without undue delay when financial interests are affected, protective measures for cyber threats, crisis communication plans and the person responsible for public communication.
How to hand incident reporting to a provider or group entity under DORA: the entity stays responsible, the authority must be told first, aggregated reports for provider-caused incidents, combined reports and provider incident assistance.
How to estimate the aggregated annual costs and losses of major incidents that supervisors can request: which incidents count, choosing the reference year, gross costs and recoveries, the classification method and the cost threshold for a major incident.
How DORA treats repeated incidents: the six-month, same root cause test, the monthly assessment, aggregated reporting, root cause procedures and the policy duty to analyse patterns in incident frequency.
What DORA expects after a major incident: the post-incident review and what it must assess, root cause analysis in the final report, evidence retention, feeding lessons back, and incident-driven reviews of the ICT risk management framework.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.