DORA Incident Reporting

DORA Incident Report Generator

1. Incident details

Timeline

Incident detected (date & time)When you became aware of the incident. The initial notification is due no later than 24 hours after it. Classified as major (date & time)The 4-hour clock of the initial notification runs from this. Initial notification submitted (date & time, optional)The 72-hour clock of the intermediate report runs from this. Until you enter it, the latest permissible time is used. Latest intermediate report submitted (date & time, optional)The one-month clock of the final report runs from this. Until you enter it, the latest permissible time is used.

Reporting entity

Reporting financial entity *Legal name of the financial entity submitting the report.LEI code20-character Legal Entity Identifier of the reporting entity.Type of financial entityCategory of financial entity as defined in DORA Article 2.Competent authority *The national competent authority to which the report is submitted.Incident reference code *Unique reference assigned by the entity to track the incident across all reports.Type of report *Indicate which of the three report stages this submission represents.Reporting currencyCurrency used for all monetary amounts in the report.Submitting entity (if different)Name and LEI of the third party submitting on behalf of the entity, if applicable.

Classification test (Art. 18 / RTS 2024/1772, Art. 8)

Major = critical services affected, and either a malicious access that may result in data losses, or two or more of the other thresholds.

Critical services affected (the gate): Tick if the incident affects ICT services that support a critical or important function, a financial service that requires authorisation, registration or supervision, or constitutes a successful, malicious and unauthorised access (RTS 2024/1772, Art. 6). Without it, the incident is not major. Malicious access that may result in data losses: Tick if a successful, malicious and unauthorised access to your network and information systems has occurred and may result in data losses (Art. 9(5)(b)). With critical services affected, this alone makes the incident major. Clients, financial counterparts and transactions affected: Tick if more than 10% of the clients using the affected service (or more than 100,000 of them), more than 30% of its financial counterparts, or more than 10% of its daily transactions by number or value are affected, or a client or counterpart identified as relevant (Art. 9(1)). Reputational impact: Tick if the incident has been reflected in the media, caused repetitive complaints from different clients or counterparts, puts regulatory requirements at risk, or is likely to cost you clients or counterparts with a material impact (Art. 9(2)). Duration and service downtime: Tick if the incident has lasted longer than 24 hours, from occurrence to resolution, or service downtime has exceeded 2 hours on ICT services that support a critical or important function (Art. 9(3)). Geographical spread: Tick if the incident has had an impact in two or more Member States: clients and counterparts, branches or group entities, market infrastructures or third-party providers (Art. 9(4)). Data losses (availability, authenticity, integrity, confidentiality): Tick if an impact on the availability, authenticity, integrity or confidentiality of data harms your business objectives or your ability to meet regulatory requirements (Art. 9(5)(a)). Economic impact: Tick if the direct and indirect costs and losses, counted before financial recoveries, have exceeded or are likely to exceed EUR 100,000 (Art. 9(6)).

No criteria selected yet.

Initial notification fields

Date and time of detectionWhen the entity first became aware of the incident.Date and time of classification as majorWhen the incident was assessed as meeting the major-incident thresholds.Date and time the incident occurredBest estimate of when the incident actually started, if known.Description of the incident *Concise summary of what happened and how it was discovered.Has the incident been reclassified?State whether the classification changed after initial assessment.Classification criteria triggered *State why the incident is major under RTS 2024/1772, Art. 8(1): critical services affected, plus either a malicious access that may result in data losses or the two or more thresholds met.Affected functions and services *Identify the business functions and ICT services impacted, noting any critical or important functions.Are other financial entities affected?Indicate whether the incident has or may have spread to other entities.Origin of the incidentPreliminary indication of where the incident originated.Business continuity measures activated?State whether business continuity or disaster recovery plans have been triggered.Is the incident still ongoing?Current status of the incident at the time of notification.Contact person detailsName and contact information of the person handling the incident.

Intermediate report fields

Updated classification assessmentConfirm or revise the criteria triggered and any change in severity.Current incident statusState the operational status of the incident at the time of this report.Type of incidentBest categorisation of the nature of the incident.Preliminary root causeInitial findings on what caused the incident, even if not yet confirmed.Affected ICT assets and infrastructureDescribe the systems, networks, applications and data assets impacted.Updated affected functions and servicesRevised list of impacted functions, confirming critical or important functions affected.Impact on clients and financial counterpartsQuantify clients, counterparts and transactions affected with updated figures.Impact on financial interestsDescribe any impact on clients' financial interests, funds or data.Geographical spreadList the Member States and regions affected by the incident.Temporary remediation actions takenDescribe interim measures applied to contain or mitigate the incident.Has the incident recurred?State whether the incident has happened again since the initial notification.Indicators of compromiseProvide any technical indicators relevant to a malicious incident, if applicable.

Final report fields

Root cause analysisDetailed and confirmed explanation of the underlying cause of the incident.Confirmed classificationFinal confirmation of the criteria met and the major status of the incident.Permanent resolution measuresDescribe the corrective actions that permanently resolved the incident.Date and time of permanent resolutionWhen normal operations were fully and permanently restored.Total duration and downtimeTotal elapsed duration of the incident and cumulative service downtime.Gross economic impactTotal gross direct and indirect costs and losses caused by the incident.Net economic impactCosts net of any financial recoveries such as insurance or recovered funds.Financial recoveries and insuranceDetail any amounts recovered through insurance, clawbacks or other means.Final data losses assessmentConfirm any loss of availability, authenticity, integrity or confidentiality of data.Recurrence prevention measuresDescribe permanent measures put in place to prevent the incident recurring.Lessons learnedSummarise key takeaways and improvements to processes, controls or governance.Other authorities or parties informedList any other authorities, law enforcement or affected parties notified.

2. Your report drafts

Initial due

- fill timeline -

Intermediate due

Final due

within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it · intermediate: within 72 hours of the initial notification, and again whenever there is a relevant status update · final: no later than one month after the latest intermediate report, once the root cause has been addressed and actual impact figures are available (Delegated Regulation (EU) 2025/301, Art. 5). A deadline falling on a weekend or bank holiday moves to noon of the next working day, except for the initial notification and intermediate report of credit institutions, central counterparties, trading venues and NIS2 entities; the dates shown do not apply that extension.

Initial notification

Fill the form and press Generate.

Intermediate report

Unlock the full report packIntermediate + final drafts and clean print/copy export. Unlock: €99

Final report

Included with the licence Unlock: €99

The initial (4h) draft is free. The licence (€99, one-off) unlocks the intermediate & final drafts and clean print/PDF export: reusable for every incident.

Drafts are generated locally in your browser. This tool is a professional aid, not legal advice; verify against your competent authority's current template before filing.

Questions

Is this a subscription?

No. It is a one-off licence with no renewal: you keep access.

What can I do without paying?

Fill in the form, compute your deadlines, run the Article 8 major-incident test of RTS 2024/1772, and generate the initial notification draft. The intermediate and final drafts, plus clean print and copy export, need the licence.

Does it submit the report to my authority?

No. It produces the drafts; you review them and submit through your own supervisory channel.

Which deadlines does it compute?

The initial notification (4 hours from classification, no later than 24 hours from awareness), the intermediate report (72 hours from the submission of the initial notification) and the final report (one month from the latest intermediate report), as set by Delegated Regulation (EU) 2025/301, Article 5.

Is my incident data sent anywhere?

No. The drafts are generated in your browser.

Practitioner tools for DORA compliance teams

Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.

academy-bundle

DORA Certifications Bundle

399 € excl. VAT

academy

DORA for IT & Security Teams

199 € excl. VAT

academy

DORA for ICT Providers & Vendors

199 € excl. VAT

Browse the full library · Excel toolkits · Certifications

How Compliant Is Your Institution?

Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.

Get Your Free DORA Score Join the Webinar Waiting List