DORA Incident Reporting

DORA Incident Report Generator

1. Incident details

Timeline

Incident detected (date & time) Classified as major (date & time)Deadlines are computed from this.

Reporting entity

Reporting financial entity *Legal name of the financial entity submitting the report.LEI code20-character Legal Entity Identifier of the reporting entity.Type of financial entityCategory of financial entity as defined in DORA Article 2.Competent authority *The national competent authority to which the report is submitted.Incident reference code *Unique reference assigned by the entity to track the incident across all reports.Type of report *Indicate which of the three report stages this submission represents.Reporting currencyCurrency used for all monetary amounts in the report.Submitting entity (if different)Name and LEI of the third party submitting on behalf of the entity, if applicable.

Classification criteria (Art. 18 / RTS 2024/1772)

Clients, financial counterparts and transactions affected — Assess the absolute number and relative share of clients, financial counterparts and transactions impacted, and whether they are material to the entity's operations. Reputational impact — Assess whether the incident has been reflected in media, generated complaints, or risks losing clients or breaching legal or regulatory obligations. Duration and service downtime — Measure the length of the incident and the total downtime of the affected ICT services from detection to restoration. Geographical spread — Assess whether the incident affects two or more EU Member States and the significance of activities in those areas. Data losses (availability, authenticity, integrity, confidentiality) — Assess any impact on the availability, authenticity, integrity or confidentiality of data caused by the incident. Criticality of services affected — Assess whether critical or important functions, or services subject to authorisation or supervision, were impacted. Economic impact — Estimate the gross direct and indirect costs and losses, judged in absolute terms and relative to the entity's size.

No criteria selected yet.

Initial notification fields

Date and time of detectionWhen the entity first became aware of the incident.Date and time of classification as majorWhen the incident was assessed as meeting the major-incident thresholds.Date and time the incident occurredBest estimate of when the incident actually started, if known.Description of the incident *Concise summary of what happened and how it was discovered.Has the incident been reclassified?State whether the classification changed after initial assessment.Classification criteria triggered *List which of the seven materiality criteria led to the major classification.Affected functions and services *Identify the business functions and ICT services impacted, noting any critical or important functions.Are other financial entities affected?Indicate whether the incident has or may have spread to other entities.Origin of the incidentPreliminary indication of where the incident originated.Business continuity measures activated?State whether business continuity or disaster recovery plans have been triggered.Is the incident still ongoing?Current status of the incident at the time of notification.Contact person detailsName and contact information of the person handling the incident.

Intermediate report fields

Updated classification assessmentConfirm or revise the criteria triggered and any change in severity.Current incident statusState the operational status of the incident at the time of this report.Type of incidentBest categorisation of the nature of the incident.Preliminary root causeInitial findings on what caused the incident, even if not yet confirmed.Affected ICT assets and infrastructureDescribe the systems, networks, applications and data assets impacted.Updated affected functions and servicesRevised list of impacted functions, confirming critical or important functions affected.Impact on clients and financial counterpartsQuantify clients, counterparts and transactions affected with updated figures.Impact on financial interestsDescribe any impact on clients' financial interests, funds or data.Geographical spreadList the Member States and regions affected by the incident.Temporary remediation actions takenDescribe interim measures applied to contain or mitigate the incident.Has the incident recurred?State whether the incident has happened again since the initial notification.Indicators of compromiseProvide any technical indicators relevant to a malicious incident, if applicable.

Final report fields

Root cause analysisDetailed and confirmed explanation of the underlying cause of the incident.Confirmed classificationFinal confirmation of the criteria met and the major status of the incident.Permanent resolution measuresDescribe the corrective actions that permanently resolved the incident.Date and time of permanent resolutionWhen normal operations were fully and permanently restored.Total duration and downtimeTotal elapsed duration of the incident and cumulative service downtime.Gross economic impactTotal gross direct and indirect costs and losses caused by the incident.Net economic impactCosts net of any financial recoveries such as insurance or recovered funds.Financial recoveries and insuranceDetail any amounts recovered through insurance, clawbacks or other means.Final data losses assessmentConfirm any loss of availability, authenticity, integrity or confidentiality of data.Recurrence prevention measuresDescribe permanent measures put in place to prevent the incident recurring.Lessons learnedSummarise key takeaways and improvements to processes, controls or governance.Other authorities or parties informedList any other authorities, law enforcement or affected parties notified.

2. Your report drafts

Initial due

- fill timeline -

Intermediate due

Final due

within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it · intermediate: within 72 hours of the initial notification, and again whenever there is a relevant status update · final: no later than one month after the latest intermediate report, once the root cause has been addressed and actual impact figures are available

Initial notification

Fill the form and press Generate.

Intermediate report

Unlock the full report packIntermediate + final drafts and clean print/copy export. Unlock — €99

Final report

Included with the licence Unlock — €99

The initial (4h) draft is free. The licence (€99, one-off) unlocks the intermediate & final drafts and clean print/PDF export — reusable for every incident.

Drafts are generated locally in your browser. This tool is a professional aid, not legal advice; verify against your competent authority's current template before filing.

Questions

Is this a subscription?

No. It is a one-off licence with no renewal — you keep access.

What can I do without paying?

Fill in the form, compute your deadlines, run the seven-criterion classification check, and generate the initial notification draft. The intermediate and final drafts, plus clean print and copy export, need the licence.

Does it submit the report to my authority?

No. It produces the drafts; you review them and submit through your own supervisory channel.

Which deadlines does it compute?

The initial notification, the intermediate report and the final report, counted from the detection and classification times you enter.

Is my incident data sent anywhere?

No. The drafts are generated in your browser.

Practitioner tools for DORA compliance teams

Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.

academy-bundle

DORA Certifications Bundle

399 € excl. VAT

academy

DORA for IT & Security Teams

199 € excl. VAT

academy

DORA for ICT Providers & Vendors

199 € excl. VAT

Browse the full library · Excel toolkits · Certifications

How Compliant Is Your Institution?

Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.

Get Your Free DORA Score Join Free Monthly Webinar