DORA major incident costs and losses: how to estimate them

How to estimate DORA annual costs and losses of major ICT incidents

A competent authority can ask an entity other than a microenterprise to report an estimate of the aggregated annual costs and losses caused by major ICT-related incidents under Article 11(10) of DORA. This estimate covers only incidents classified as major for which a final report was submitted in the reference year, or earlier if they affected that year's costs. It is built from gross costs and losses and financial recoveries under the ESAs' Joint Guidelines JC 2024 34, which apply from 19 May 2025. Costs from non-major incidents are out of scope, so the first task is to pull the register of major incidents and confirm which final reports fall inside the chosen window. The organization owns this estimate and its sign-off. An independent auditor does not issue it unless the organization engages one for assurance, and that engagement is a separate decision with its own scope and fee.

The figures will differ between entities for three reasons: how many major incidents occurred, which reference year the entity chose, and how each cost was booked. Under JC 2024 34, the entity chooses whether the reference year is the completed calendar year or its completed accounting year, and it must keep using that basis. Changing it requires notifying the competent authority, which has 2 months to object. Before choosing, finance and risk should agree on which basis gives a stable, traceable picture across years. Gross costs and losses are the amounts paid or booked, and financial recoveries are reported separately, broken down by major incident. Confirm with your competent authority how it expects those recoveries to be presented, since the guidelines leave the subtraction to supervisors.

Which incidents count toward the DORA cost estimate

The cost estimate covers a narrow set of incidents, so the first job is filtering the incident log. Each test below removes incidents that do not belong, and together they define the population a supervisor can ask you to quantify.

Classified as major

Only incidents your entity has classified as major under the incident classification standard count. Non-major incidents are out of scope, even when they caused real disruption or cost. Check the classification record for each entry, not your internal severity label, because the two often differ. Keep the date of the classification decision so you can show when it was made.

Final report submitted in year

The incident must have a final report submitted in the reference year. An incident whose final report falls in a different year is not counted for that year merely because it started or was discovered then. Confirm the submission date against your reporting records and note any incident whose final report is still pending at the close of the reference year.

Earlier incidents with current-year costs

An incident with a final report from an earlier year still counts if it affected costs or losses in the reference year. Typical cases are remediation invoices, settlements or provisions booked after the report was filed. Review open cost lines for every prior-year major incident before you close the estimate, and record which booked amounts fall inside the reference year.

Costs and losses threshold

The EUR 100,000 costs and losses threshold is one of the Article 9 tests that can make an incident major. Use the gross costs and losses figure from the classification assessment to confirm that the incident met it. If the classification relied on another threshold, such as client numbers or duration, the cost test is still a separate check you must document.

Affected service and critical functions

Test whether the incident involved an ICT service that supports a critical or important function. Duration and downtime tests for these services are stricter, so an incident of modest scale may still be major. Map each log entry to the affected service in your register of information, and flag any entry where the service link is missing or disputed.

Provider-caused incidents

Incidents caused by an ICT third-party provider remain your responsibility for classification and cost reporting. Confirm whether the provider's losses, service credits or recoveries are part of your gross figures, and whether a group or outsourced reporting arrangement changes who holds the records. Ask providers for the cost data you need now, because it is hard to obtain after the fact.

Choosing the reference year and booking gross costs and recoveries

The first decision is the reference year. Under the ESAs' Joint Guidelines JC 2024 34, a financial entity chooses either the completed calendar year or its completed accounting year, and it must apply that choice consistently. Pick the basis that matches how your finance function already closes the books, because the figures you report must reconcile to ledgers that an authority can compare with your financial statements. If you later want to switch, you must notify your competent authority first. The authority then has two months to object, so plan the change well ahead of any request for an estimate rather than in response to one. Record the chosen basis in your policy documentation so the next person preparing the estimate uses the same year-end logic.

Within that year, the Guidelines ask for two separate figures for each major incident. The first is gross costs and losses, meaning the amounts actually paid or booked in the reference year. Gross figures follow the same approach as the incident classification standard in Delegated Regulation (EU) 2024/1772, so the cost of an incident is assessed the way the classification rules already require. The second is financial recoveries, such as insurance payments or compensation received, which follow the approach of the incident reporting standards. Keep recoveries as their own line rather than netting them off, because the ESAs dropped net figures after consultation: authorities can subtract recoveries themselves, and a single net number hides how much was lost and how much was recovered.

Practically, set up a separate cost centre or ledger tag for each major incident as soon as it is classified, so amounts booked in the reference year can be traced back to a specific incident report. Confirm with your finance team how provisions, accruals and staff time are treated, since these choices change what counts as booked. Ask your auditors how they would test the figures, and document every assumption behind the estimate. An estimate that cannot be traced to ledger entries is harder to defend, even when the numbers are correct.

What the cost estimate costs to produce

This table breaks down who spends money or effort to produce the annual cost and loss estimate, whether each cost is one-time or recurring, and what drives it up. Use it to structure a quote request and to decide which parts you need outside help for, since the estimate itself is only requested by the competent authority on request.

Cost component	Who is paid or spends effort	One-time or recurring	What drives it
Incident data model and reporting workflow	Implementation partner, with internal IT and incident owners	One-time setup, then periodic updates	Number of ICT systems in scope, how incidents are already logged, and whether major incidents are tagged consistently
Incident and ticketing tooling	Internal platform team or the tooling vendor, if licensed	Mostly recurring (licences, hosting, maintenance)	Whether existing ticketing can hold cost fields, the number of incidents per year, and retention needs
Gross cost and loss capture	Internal finance staff, with risk staff validating which bookings belong to each incident	Recurring, once per reference year	Number of major incidents in the reference year, how finance codes costs, and whether costs span several accounting periods
Recoveries tracking	Internal finance and claims or insurance staff	Recurring, once per reference year	Number of insurance claims, contractual recoveries from ICT providers, and how quickly recoveries are booked
Reference year and basis decisions	Internal finance and risk leads, with compliance sign-off	One-time decision, revisited only if the basis changes	Calendar year versus accounting year. A change requires notice to the competent authority, which has 2 months to object
Independent assurance over the figures (optional)	External auditor or assessor, engaged by the entity	Recurring if engaged each year, otherwise on demand	Whether the authority asks for assurance, the complexity of cost allocation, and how well the data trail is documented
Written quote structure	Implementation partner and tooling vendors, provided on request	Requested before work starts	Ask for separate line items for data preparation and annual reporting so one-time and recurring costs are not mixed

Who owns the estimate, who prepares the data, and who assures it

The financial entity owns the estimate. When its competent authority requests the aggregated annual costs and losses caused by major ICT-related incidents, the entity's management body and accountable executives decide the reference year, apply the classification approach, and sign off the figures it submits. Finance owns the booked amounts and the recoveries, while the ICT risk function owns the incident classification and the link between each incident and its cost. Responsibility does not move to a vendor because a vendor helped gather the data.

Reference year decision: Finance and risk agree whether the entity uses the completed calendar year or its completed accounting year, record the choice, and keep it unless the competent authority is notified and does not object within 2 months.
Gross figures and recoveries: Finance supplies amounts paid or booked for each major incident, plus financial recoveries, kept separate so the authority can net them.
Scope control: Risk confirms which incidents were classified as major with a final report in the reference year, and excludes non-major incidents.
Sign-off trail: Named executives approve the submission, and the approval and its basis are retained as evidence.
Internal review: Internal audit or a second reviewer checks the calculation method against the joint guidelines before submission.

Confirm who in your organization can sign the submission and whether your board has delegated this authority in writing.",

How the estimate is built, step by step

The sequence turns scattered incident records into one annual figure that the entity can defend to its competent authority, with each step leaving a documented output that the next step relies on.

Confirm entity type and microenterprise status
The compliance lead confirms the entity's category under DORA and whether it qualifies as a microenterprise. Under Article 11(10), entities other than microenterprises must be ready to report an estimate on request, so this answer decides whether the estimate is needed at all. The output is a short written determination, signed off by the person accountable for ICT risk, stating the entity type, the status and the regulatory basis relied on. Confirm the current status with the competent authority if the entity sits on a boundary.
Fix the reference year and basis
Choose whether the reference year is the completed calendar year or the completed accounting year. Under the ESAs' Joint Guidelines JC 2024 34, the choice must then stay consistent, and changing it requires notifying the competent authority, which has 2 months to object. The output is a recorded decision naming the basis, the year and the reason for the choice, so that later estimates can be compared on the same footing.
List major incidents with final reports
Pull the incident register and select every incident classified as major for which a final report was submitted in the reference year. Include earlier incidents only if they affected that year's costs. Non-major incidents fall outside the estimate. The output is a list of incident identifiers, classification dates, final report dates and a short note on why each one is in scope. Reconcile the list against submitted reports so that no reported major incident is missing.
Capture gross costs and losses per incident
For each listed incident, record the gross costs and losses, meaning amounts paid or booked, broken down by incident. Assess them with the same approach used for incident classification under Delegated Regulation (EU) 2024/1772. Finance, operations and the business owners of affected services typically supply the figures, while the compliance function sets the cut-off and definitions. The output is one table row per incident with cost categories, amounts and the source document for each amount.
Record financial recoveries per incident
Record any financial recoveries for each incident, such as insurance receipts, supplier credits or contractual compensation, using the approach set by the incident reporting standards. Keep recoveries separate from gross costs, because the guidelines ask for gross figures and recoveries as distinct inputs. Authorities can net the recoveries off themselves. The output is a recoveries register aligned to the same incident identifiers, with the status of each recovery (received, agreed or pending) and its source.
Reconcile to the general ledger
Compare the incident-level totals for costs and recoveries with the relevant accounts in the general ledger for the reference year. Investigate every difference and document whether it reflects timing, classification, a cost outside the incident scope or an error. The output is a reconciliation schedule showing ledger totals, incident totals and each explained variance, signed off by finance. Without this step, the figure may not hold up when the authority asks how it was derived.
Document the method and retain workpapers
Write a short method note covering the scope, reference year, cost categories, the classification approach, exclusions and the reconciliation results. Store it with the workpapers, the source documents and sign-offs in a location that the compliance function controls and that can be produced on request. The output is a complete, dated evidence file that lets a reviewer or independent assessor trace each figure back to its source. Ask the internal audit function to review the file before submission.

What makes the estimate harder or easier to produce

The estimate of aggregated annual costs and losses is only as good as the records behind it. The drivers below decide whether finance and incident teams can attribute each cost to a specific major incident in the reference year, or whether they end up reconstructing figures under pressure.

Number of major incidents

Every major incident in the reference year adds cost lines to trace, reconcile and split into gross costs and recoveries. A short list of incidents with clear tickets is manageable by hand, while a long list needs a repeatable extraction. Ask how many incidents were classified as major, which ones have final reports, and whether any affected costs in the reference year despite an earlier start date.

Cost code setup in finance systems

If finance systems do not have a code or project reference for ICT incidents, costs such as overtime, emergency vendor work and replacement hardware land in general ledger lines shared with routine operations. Agree an incident cost code scheme with finance before an incident occurs, and check that the codes match the incident identifiers used in the classification records.

Incident tickets linked to cost centers

Tickets that record effort but not the cost center or purchase order behind it make attribution guesswork. Check whether the ticketing tool can hold the major incident reference, and whether staff time, cloud consumption and third-party invoices can be tied to that reference. Without this link, the reference year total cannot be reproduced for a supervisor.

Multi-entity group reporting

In a group, the affected entity may be a subsidiary that books costs in a parent or shared service company. Confirm which legal entity carries each cost, how intra-group recharges are handled, and which entity the estimate covers. Agree the mapping in writing so that the same incident is not counted twice or omitted from either entity's return.

Outsourced provider invoices arriving late

Provider invoices for an incident often arrive months after the work was done, which can fall outside the reference year or be missing when the estimate is requested. Build an accrual or provision process for incident-related provider work, and record the expected amounts in the incident file. Confirm contract terms for invoice timing and how credits or service level penalties will be recorded as recoveries.

Root cause record quality

The estimate depends on knowing which costs belong to which incident, and root cause records show whether a later failure is a continuation of an earlier one. Vague or missing root cause entries lead to disputes about whether costs belong to one incident or several. Check that each final report and root cause note names the affected services, the start and end times, and the cost codes used, so the reference year figures can be defended.

Why supervisors ask for this figure

Supervisors ask for this estimate because they need to see aggregate exposure to operational incidents across the financial entities they oversee, not only the record of each incident. Under Article 11(10) of DORA, entities other than microenterprises report to their competent authority, on request, an estimate of the aggregated annual costs and losses caused by major ICT-related incidents. A single incident report shows what happened; the annual total shows how much operational failure is costing a firm, and how that cost compares with the firm's risk appetite and capital planning. The policy context explains the emphasis. The impact assessment SWD(2020) 199 cites industry assessments putting the cost of operational incidents for the EU financial sector at between EUR 2 billion and EUR 27 billion per year. That range is context for why the legislator wanted supervisors to measure the problem, not a benchmark for any one firm, and it should not be quoted as an expected loss for your organization.

The request is about visibility over time. Incident reports arrive one at a time and are often assessed on their own, so a series of individually modest major incidents can look manageable while their combined cost is material. An aggregated figure lets the authority compare entities of similar size and profile, spot sectors or service types where losses cluster, and judge whether the entity's ICT risk management framework is working. It also gives the authority a basis for supervisory dialogue when costs rise from one year to the next. Your organization should therefore be able to reproduce the figure from its own books at any time, and not assemble it under pressure after a request arrives.

Before the first request arrives, confirm three things with your finance and risk functions: which person owns the estimate, which cost ledgers feed it, and whether your competent authority has issued any specific expectations beyond the ESAs' Joint Guidelines JC 2024 34. Ask whether the figure will be reviewed by internal audit, and how its underlying records will be retained. These decisions are internal, so no external party can make them for you, although an implementation partner can help you design the data flow and evidence trail.

What must be in place before the first estimate

An estimate of aggregated annual costs and losses is only as good as the records behind it. The five items below are the inputs an assessor will expect to trace, and each one can be checked in your own environment before a competent authority asks for the figure.

Major incident register with classification records

Each major ICT-related incident needs its own entry showing the date, the affected services and the classification decision under the incident classification standard. Only major incidents with a final report in the reference year fall in scope, so the register must separate them from non-major events. To check this, pick three incidents at random and confirm each has a dated classification record, the criteria it met (including any Article 9 thresholds) and a named approver. Entries that cannot be traced to a record are a gap.

Final reports on file

The estimate draws on the final report submitted for each major incident, so a missing final report removes that incident from scope or leaves its costs unexplained. Confirm that every major incident in the register has a submitted final report, the submission date and a copy kept under your retention rules. Also check whether any incident that began in an earlier year still affected costs in the reference year, because the guidelines reach those too.

Finance mapping to cost codes

Gross costs and losses are amounts paid or booked, so each incident needs a route from the ledger to its incident ID. Ask finance which cost centers, provisions and loss accounts capture incident response, external forensic work, customer remediation and write-offs. Test the mapping by tracing one closed incident from its ticket to the booked entries. Costs that cannot be linked to an incident should be listed separately rather than assigned by estimate.

Documented method aligned to JC 2024 34

Your method must state the reference year basis (completed calendar or accounting year), how gross costs and losses are valued, and how financial recoveries are measured. The guidelines require the same valuation approach used for incident classification under Delegated Regulation (EU) 2024/1772 and the incident reporting approach for recoveries. Check that the document names the basis, records any notified change and its two-month objection window, and cites the guidelines and standard by reference. Auditors reviewing the estimate will look for this document first.

Named sign-off owner

A named individual, usually at management body or senior management level, must approve the estimate before it goes to the competent authority. That owner should be accountable for the method, the register and the finance mapping, and should be able to explain any figure. Confirm in your governance documents who holds this role, that the appointment is recorded, and that a deputy exists so a request is not blocked by absence. Consultants can prepare the workpapers, but the sign-off stays with your organization.

Questions buyers ask about DORA incident cost estimates

Do non-major ICT incidents have to be included in the annual cost estimate?

No. The estimate covers only incidents classified as major for which a final report was submitted in the reference year, or earlier if they affected that year's costs. Costs and losses from non-major incidents are out of scope of the ESAs' Joint Guidelines JC 2024 34, so they do not need to be added, even if they were painful for your teams. Keep the classification records for each incident so you can show why an event was or was not counted. The classification itself follows the criteria in Delegated Regulation (EU) 2024/1772.

Is a DORA incident cost estimate due every year?

Not automatically. Under Article 11(10), entities other than microenterprises report the estimate to their competent authority on request. Your supervisor decides when to ask, so the practical requirement is to be able to produce the figure for the reference year when asked. Many organizations keep the calculation current each year so that a request can be answered without a rush. Confirm with your competent authority how it expects to receive the estimate and in what format.

Do recoveries reduce the costs figure I report?

No. The Joint Guidelines ask for gross costs and losses, meaning amounts paid or booked, and financial recoveries as a separate item for each major incident. The ESAs dropped net figures after consultation because supervisors can subtract recoveries themselves. Report the gross amounts and the recoveries side by side so the authority can see both. Recoveries should be assessed with the same approach as the incident reporting standards, and gross costs with the approach used for incident classification.

Must a microenterprise report incident costs and losses?

No. Article 11(10) applies the estimate obligation to financial entities other than microenterprises. A microenterprise does not have to report this estimate under that provision. Check whether your entity is classified as a microenterprise under the relevant rules and whether any other DORA obligation applies to you, because the exemption covers this one estimate only.

Does an external auditor have to check the cost estimate?

The cited sources do not require an external audit of the estimate. The obligation is to provide it to the competent authority on request, using the Joint Guidelines. Whether your authority expects independent assurance, or whether internal sign-off is enough, is a question to put to that authority directly. If you choose outside help, be clear about roles: an implementation partner can prepare the calculation and supporting records, while the organization remains responsible for the figures it submits.

Can our own finance and incident teams prepare the estimate internally?

Yes, the Joint Guidelines do not require an outside party. The work needs three inputs: the list of major incidents with final reports in the reference year, the gross costs and losses booked against each one, and the recoveries received. Finance usually owns the amounts, while the incident management team confirms which events were major and when they affected costs. Most of the effort is in matching bookings to incidents, so agree on a cost-coding approach before the next incident occurs.

What drives the effort of producing the estimate?

The main driver is how well incident costs are recorded at the time they occur. Effort rises when costs are spread across several ledgers, when staff or provider charges are not tagged to an incident, or when the reference year and accounting year are handled inconsistently. Choosing between the completed calendar year and the completed accounting year is a one-time decision, but you must keep the same basis afterwards and notify your competent authority, which has 2 months to object, before changing it. Ask any outside party for a fixed-scope written proposal that lists the incident records, ledger sources and review steps it will cover.

How self-hosted open-source platforms support cost capture

The estimate is only as defensible as the records behind it, and self-hosted open-source platforms running inside the organization's own infrastructure can hold those records in one place. The aim is to link every cost and loss entry to a single incident ID, so that each amount in the annual figure can be traced back to the major incident that caused it and to the final report submitted for it. Typical sources are the incident ticketing system, the log platform that shows when services were degraded, and the finance or procurement records where invoices for external recovery work, overtime, fines or service credits are booked. Because these systems run in the organization's own cloud accounts, data centers or air-gapped networks, the organization decides how long they are kept and who can change them.

Retention matters as much as linkage. The reference year can be the completed calendar year or the completed accounting year, and costs from an incident may arrive in a later year than the one in which it occurred, so the records must survive for the whole period the estimate covers and for any prior-year incident whose costs fall into that year. Confirm the retention settings of each platform in your own environment, including backup restore tests, rather than assuming the default. Check whether the ticketing tool, log store and accounting export can each filter by an incident ID or tag, whether closed tickets and archived logs remain queryable, and whether exports keep timestamps and currency fields intact. Vendor documentation for the specific version you run is the place to confirm these features, and a configuration review in a test copy is the way to prove them.

Ask your implementation partner for a short evidence map before the first estimate is requested. It should list each platform, the fields that carry the incident ID, the export format, the owner of each dataset and the retention period, and it should show how a sample incident traces from a ticket to a cost entry to a final report. The partner can prepare and document these configurations, but the organization owns the data and the figures it submits to its competent authority, and an independent auditor will test whether the records support them.

How DeployOpen prepares incident records and cost evidence

DeployOpen works on the systems and records that feed a DORA annual cost and loss estimate for major ICT incidents, inside your own infrastructure. We prepare the incident data, cost sources and evidence trail so your team can answer a competent authority request, while the organization keeps ownership of the figures and the estimate.

How we scope

We agree in writing which systems, incident records and cost sources the estimate will draw on before work starts.
The written scope names the reference year basis, calendar or accounting, and who in your organization signs off the figures.
Engagements are fixed-scope, with deliverables and timelines confirmed in writing before any work begins.
Ask us to confirm which incident tickets, finance ledgers and recovery records are in scope for your entity.

How we build

We set up incident registers that tag each major incident with its final report date and affected cost lines.
We map gross costs and losses and separate financial recoveries so each figure can be traced to a booked amount.
We build reproducible queries and exports from your self-hosted ticketing, logging and finance tools inside your environment.
We record the classification basis used for each incident so the cost approach matches your classification records.

How we hand over

We deliver the incident cost register, the calculation workpapers and a written method note for your records.
We document the reference year choice and any change notices so the basis stays consistent across reporting cycles.
Handover includes runbooks so your staff can refresh the estimate when a new reference year starts.
The estimate itself remains the organization's statement, and independent auditors review it where your processes require.

How we support

Ongoing support and periodic refreshes of the cost register are available as a retainer.
Retainer work can cover updates when the Joint Guidelines, related technical standards or your incident process change.
We can help your team prepare for supervisor questions by walking through the evidence trail behind each figure.
Ask us to confirm the support scope, response expectations and review cadence in the written agreement.