DORA Chapter III (Articles 17 to 23): the incident management process, classification of incidents and cyber threats, mandatory reporting of major incidents, voluntary notification of significant cyber threats, and payment-related incidents.
The process to detect, manage and notify ICT-related incidents: recording all incidents and significant threats, early warning indicators, classification procedures, roles, communication and escalation, management reporting and root cause follow-up.
The six criteria for classifying incidents, the materiality thresholds in Delegated Regulation (EU) 2024/1772 that make an incident major, the rule for recurring incidents, and the conditions for a significant cyber threat.
Reporting major ICT-related incidents to the competent authority through an initial notification, intermediate report and final report within set deadlines, informing affected clients, voluntary threat notification and outsourcing of reporting.
How DORA's incident chapter extends to operational or security payment-related incidents at credit institutions, payment institutions, account information service providers and e-money institutions, replacing PSD2 incident reporting for them.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.