DORA Certifications Bundle
399 € excl. VAT
Commission Delegated Regulation (EU) 2024/1772
Digital Operational Resilience Act (DORA)
Objective: This RTS gives content to the classification criteria of DORA Article 18(1) and sets the materiality thresholds that make an ICT-related incident "major", the event that triggers the reporting duty of Article 19(1). It also sets the thresholds for significant cyber threats (Article 10).
The test in one sentence (Article 8(1)): an incident is major when it has affected critical services (Article 6) and either a successful, malicious and unauthorised access that may result in data losses has occurred (Article 9(5)(b)), or two or more of the other materiality thresholds of Article 9 are met.
Why it matters: classification starts the reporting clock. The initial notification is due as early as possible, within 4 hours of classification and no later than 24 hours after the financial entity became aware of the incident (Delegated Regulation (EU) 2025/301, Article 5(1)(a)).
Two common misreadings:
Articles 1 to 7 of the RTS specify each criterion of DORA Article 18(1). Article 9 sets a materiality threshold for six of them. The criticality of services affected has no threshold: it is the gate of Article 8(1).
| # | Criterion (RTS article) | What you assess | Materiality threshold (Article 9) |
|---|---|---|---|
| 1 | Clients, financial counterparts and transactions (Art. 1) | Clients unable to use the service or adversely impacted; financial counterparts with a contractual arrangement; transactions with at least one part carried out in the Union | Any of: more than 10% of the clients using the affected service; more than 100,000 clients using it; more than 30% of the financial counterparts linked to the service; more than 10% of the daily average number, or value, of the service's transactions; clients or counterparts identified as relevant affected (Art. 9(1)) |
| 2 | Reputational impact (Art. 2) | Visibility the incident has gained or is likely to gain | Any of: media coverage; repetitive complaints from different clients or counterparts; regulatory requirements likely to be missed; likely loss of clients or counterparts with a material impact (Art. 9(2)) |
| 3 | Duration and service downtime (Art. 3) | Duration from occurrence to resolution; downtime from unavailability to restored service | Duration longer than 24 hours, or service downtime longer than 2 hours for ICT services that support critical or important functions (Art. 9(3)) |
| 4 | Geographical spread (Art. 4) | Impact in other Member States on clients and counterparts, branches or group entities, market infrastructures and third-party providers | Impact in two or more Member States (Art. 9(4)) |
| 5 | Data losses (Art. 5) | Availability, authenticity, integrity and confidentiality of data | (a) an impact that harms the business objectives or the ability to meet regulatory requirements; or (b) a successful, malicious and unauthorised access that may result in data losses (Art. 9(5)) |
| 6 | Criticality of services affected (Art. 6) | ICT services supporting critical or important functions; financial services requiring authorisation, registration or supervision; successful, malicious and unauthorised access | No threshold: the gate of Article 8(1) |
| 7 | Economic impact (Art. 7) | Direct and indirect costs and losses, without financial recoveries | Costs and losses that have exceeded or are likely to exceed €100,000 (Art. 9(6)) |
How to count:
The threshold is met where at least one of these has occurred: the incident has been reflected in the media; it has caused repetitive complaints from different clients or financial counterparts on client-facing services or critical business relationships; you will not, or are likely not to, meet regulatory requirements because of it; or you will, or are likely to, lose clients or counterparts with a material impact on your business. Weigh the level of visibility the incident has gained or is likely to gain (Art. 2(2)).
Assess whether the incident has had an impact in other Member States, in particular on clients and financial counterparts, on branches or other group entities active there, and on market infrastructures or third-party providers that may affect financial entities they serve. The threshold is an impact in two or more Member States (Art. 9(4)). Regions within a single country do not count towards it.
Four properties to assess:
The threshold has two limbs (Art. 9(5)). Limb (a): an impact on any of these properties that has or will have an adverse effect on your business objectives or on your ability to meet regulatory requirements. Limb (b): a successful, malicious and unauthorised access to network and information systems that may result in data losses. The RTS sets no count of records or individuals.
A personal data breach is assessed separately under Article 33 GDPR: the two tests do not depend on each other.
Critical services are affected where the incident:
There is no threshold to measure: either the incident has affected critical services or it has not. Without this criterion, the incident is not major, whatever the other criteria show. Map your critical or important functions and authorised services to ICT assets before an incident (DORA Article 8(1)), so the answer takes minutes, not a meeting.
Count, without deducting financial recoveries (Art. 7(1)): expropriated funds or financial assets you are liable for, including theft; replacement or relocation of software, hardware or infrastructure; staff costs, including overtime, replacement and extra recruitment; fees due for breaching contractual obligations; redress and compensation to customers; forgone revenues; internal and external communication; advisory costs such as legal counselling, forensic and remediation services.
Leave out (Art. 7(2)): costs of day-to-day operation, such as general maintenance and keeping staff skills up to date; costs to enhance the business after the incident, such as upgrades, improvements and risk assessment initiatives; insurance premiums.
Threshold: the sum has exceeded or is likely to exceed €100,000 (Art. 9(6)). Calculate on the data available when you report, and estimate where the actual amounts are not yet known (Art. 7(3)).
Initial vs. final figures:
Incidents that are not major one by one are treated as one major incident where all of these conditions are met: they have occurred at least twice within 6 months; they share the same apparent root cause (DORA Article 20, first subparagraph, point (b)); and together they meet the test of Article 8(1). Run this check every month. It does not apply to microenterprises or to the financial entities listed in DORA Article 16(1). Recurring incidents are reported in aggregated form (Implementing Regulation (EU) 2025/302, Article 3).
STEP 1: The gate
STEP 2: Malicious access
STEP 3: Count the other thresholds
STEP 4: Reassess as the facts change
Scenario: a regional bank suffers a ransomware attack that encrypts its production servers.
Observed impacts:
Classification:
Verdict: MAJOR INCIDENT. Initial notification within 4 hours of classification, and no later than 24 hours after the bank became aware of the attack.
Scenario: an insurance company finds that a misconfigured API of its policyholder portal exposed data.
Observed impacts:
Classification:
Verdict: NOT MAJOR: one threshold, where Article 8(1)(b) requires two. No DORA notification. The personal data breach is assessed separately under Article 33 GDPR, and a second exposure with the same root cause within 6 months would be assessed together with this one (Art. 8(2)).
Scenario: a power failure in a cloud provider's primary datacenter interrupts the services it runs for several financial entities for 3 hours.
Bank A runs its core banking on the affected region. 40% of its clients, in France, Belgium and Luxembourg, cannot transact; costs stay at €60,000.
Bank B only lost an internal reporting tool that supports no critical or important function. Gate not met: not major, whatever the duration.
Particularity: each financial entity classifies on its own facts and reports to its own competent authority (DORA Article 19(1)). Where reporting has been outsourced to a third party under Article 19(5), that third party may file one aggregated report for several entities, provided the incident comes from the same ICT provider, is major for each of them, stays within one Member State and one competent authority, and that authority has permitted it. Significant credit institutions, trading venues and central counterparties always report individually (Implementing Regulation (EU) 2025/302, Article 7).
| Criterion | Question to Ask | Data Source |
|---|---|---|
| 6. Critical services (gate) |
☐ Does the incident affect ICT supporting a critical or important function, or an authorised service? ☐ Is there a successful, malicious and unauthorised access? |
Register of critical or important functions, ICT asset mapping, SIEM |
| 1. Clients, counterparts, transactions |
☐ What share of the service's clients, counterparts and daily transactions is affected? ☐ Is a relevant client or counterpart affected? |
Access logs, CRM, payment and transaction systems |
| 2. Reputation | ☐ Media coverage, repetitive complaints, regulatory requirements at risk, clients likely lost? | Media monitoring, complaints log, compliance |
| 3. Duration and downtime |
☐ When did the incident occur, and is it resolved? ☐ How long has the service been fully or partially unavailable? |
Monitoring system, ticketing, log timestamps |
| 4. Geography | ☐ Are clients, branches, group entities or providers in other Member States affected? | Client and branch mapping, Register of Information |
| 5. Data |
☐ Is the availability, authenticity, integrity or confidentiality of data affected? ☐ Does it harm business objectives or regulatory compliance? |
SIEM logs, DLP alerts, database audit trails |
| 7. Economic impact | ☐ Do the costs and losses of Article 7(1), before recoveries, exceed or risk exceeding €100,000? | Invoices, staff time, revenue data, accounting |
Correct: start with critical services. Without them, no combination of thresholds makes an incident major; with them, a malicious access that may result in data losses needs no second threshold.
Correct: apart from the malicious-access case, Article 8(1)(b) requires two or more thresholds.
Correct: the 10% is measured against the clients using the affected service (Art. 9(1)(a)). The 100,000 alternative is an absolute number of that service's clients.
Correct: the RTS expects estimates where actual figures are not yet known (Art. 1(5), 3(1) and 7(3)). Classify on what you know, and reclassify as the facts change.
Correct: the cause of the incident (internal, external or third party) does not change the classification. The criteria measure the impact on your services.
Correct: run the Article 8(2) check every month. A series of minor incidents with the same apparent root cause can add up to one major incident.
If you cannot meet a deadline, tell the competent authority before it expires and explain why (Article 5(3)). A deadline falling on a weekend or bank holiday moves to noon of the next working day, except for the initial notification and intermediate report of credit institutions, central counterparties, trading venues and entities that are essential or important under NIS2 (Article 5(4) and (5)).
Our experts can guide your institution through DORA compliance, from gap analysis to full implementation.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.