DORA Certifications Bundle
399 € excl. VAT
Commission Delegated Regulation (EU) 2025/301
Digital Operational Resilience Act (DORA)
Objective: This RTS defines the precise content and timelines for notification of major ICT incidents to supervisory authorities, as well as the voluntary notification process for significant cyber threats.
Key Principle: Fast, progressive and structured notification in 3 stages:
Incident Reporting Flow: from Detection to Final Report
All three reports submitted via national competent authority channel (EIOPA/EBA/ESMA depending on entity type). Times are maxima: earlier is always permitted.
Work through each question. One "YES" to Q1–Q6 makes the incident major and triggers the T+4h notification obligation.
Failure to meet deadlines constitutes a DORA violation subject to administrative penalties set by national law under Article 50.
Deadline: Maximum 4 hours after classifying the incident as "major"
Objective: Alert the supervisor that a major incident is ongoing
Minimum mandatory content:
⚠ Information NOT required at this stage:
Tip: Prepare a pre-filled template with static information (entity identification, contacts, etc.) to save time during emergency notification.
Deadline: Maximum 72 hours (3 days) after initial detection
Objective: Provide a detailed update on the situation and impact
Mandatory content:
Important note: If the incident is not resolved at T+72h, the interim report must include an action plan with expected timeline.
Deadline: Maximum 1 month (30 calendar days) after initial detection
Objective: Provide comprehensive post-incident analysis and preventive measures
Mandatory content:
| Field | Description | Mandatory? |
|---|---|---|
| Full legal name | Official corporate name | YES |
| LEI Code | Legal Entity Identifier (20 characters) | YES |
| Entity type | Bank, insurance, PSP, investment, etc. | YES |
| Country of registration | EU Member State of primary authorization | YES |
| Supervisory authority | Name of competent supervisor | YES |
| Incident contact point | Name, role, email, 24/7 phone | YES |
| Field | Description | Required T+4h | Required T+72h | Required T+1 month |
|---|---|---|---|---|
| Detection date/time | Precise timestamp (UTC) | ✓ | ✓ | ✓ |
| Start date/time | When incident actually began (may be before detection) | Estimated | ✓ | ✓ |
| Incident type |
• Cyberattack (specify: ransomware, DDoS, phishing...) • System failure • Human error • Natural disaster • Third-party provider failure |
✓ | ✓ | ✓ |
| Classification | RTS 2024/1772 criteria triggered (check all applicable) | ✓ | ✓ | ✓ |
| Affected systems | List of impacted applications, servers, networks | Partial | ✓ | ✓ |
| Impacted business functions | Payments, trading, customer service, etc. | ✓ | ✓ | ✓ |
| Status | Ongoing / Contained / Resolved | ✓ | ✓ | ✓ |
| Metric | Calculation Method | T+4h | T+72h | T+1 month |
|---|---|---|---|---|
| Number of clients | Count all clients/users unable to access the service | Estimated | Precise | Final |
| Interruption duration | Total time (cumulative if multiple outages) in hours | Ongoing | Current | Total |
| Affected transactions | Number of failed/lost/delayed transactions | Estimated | Precise | Final |
| Economic losses |
Direct costs: consultants, overtime, compensation Revenue losses: uncollected fees |
Not required | Estimated | Final |
| Compromised data |
Type of data (sensitive/non-sensitive) Number of affected individuals Type of compromise (confidentiality/integrity/availability) |
If known | ✓ | ✓ |
| Geographic extent | Affected countries/regions, closed sites | ✓ | ✓ | ✓ |
At T+4h (Initial Report):
At T+72h (Interim Report):
At T+1 month (Final Report):
Principle: In addition to the obligation to notify major incidents, financial entities MAY voluntarily notify significant cyber threats they detect, even if no incident has (yet) occurred.
| Information | Description |
|---|---|
| Threat type | Malware, phishing, DDoS, intrusion, vulnerability, etc. |
| Technical indicators |
• Malicious file hashes (MD5, SHA256) • Source IP addresses • C2 (Command & Control) domains • Malicious URLs • Attack patterns |
| Attack vector | Email, web, API, VPN, supply chain, etc. |
| Targeted systems | Targeted applications, OS, network equipment |
| Sophistication level | Low / Medium / High / APT |
| Defensive actions taken | Blocks, isolations, patches, enhanced monitoring |
⏰ Voluntary notification timeline:
No strict deadline imposed, but notification recommended as soon as possible to maximize the usefulness of the information for the sector.
Best practice: Notify within 24h of threat detection, even if analysis is not complete.
| Country/Supervisor | Portal | Format |
|---|---|---|
| France - ACPR | ROSA Portal (Operational Security and Activity Reporting) | XML per ITS 2025/302 schema |
| Germany - BaFin | BaFin MaCo Portal | XML per ITS 2025/302 schema |
| Spain - Banco de España | Portal de Supervisión | XML per ITS 2025/302 schema |
| Italy - Banca d'Italia | Portale INFOSTAT | XML per ITS 2025/302 schema |
| ECB (significant institutions) | ECB IMAS Portal | XML per ITS 2025/302 schema |
Standardized format: All supervisors accept the XML format defined in ITS 2025/302, ensuring interoperability.
Authentication: Qualified electronic certificates (eIDAS) required to submit reports.
Acknowledgment of receipt: The portal automatically generates an acknowledgment with unique incident number to retain.
| Violation | Severity | Penalty Type |
|---|---|---|
| Non-notification of major incident | VERY SEVERE |
• Fine up to 2% worldwide turnover • Public disclosure of penalty • Mandatory corrective measures |
| Notification beyond deadline (delay >24h) | SEVERE |
• Fine up to 1% worldwide turnover • Official warning |
| Incomplete or inaccurate information | MODERATE |
• Fine up to 0.5% worldwide turnover • Obligation to submit corrected report • Supervised audit |
| Intentional misclassification | VERY SEVERE |
• Fine up to 2% worldwide turnover • Individual sanctions on managers • In-depth audit |
⚠ Note: Penalties are proportionate to the severity, duration, and recurrence of the violation, as well as the degree of cooperation with authorities.
| Timing | Actions | Responsible |
|---|---|---|
| T+0 to T+2h |
• Detect and confirm incident • Activate crisis cell • Assess preliminary impact • Classify incident (major/minor) |
SOC / CERT CISO |
| T+2h to T+4h |
• Fill initial report template • Validate with Legal/Compliance • Submit on supervisor portal • Inform Executive Management |
Compliance CEO |
| T+4h to T+72h |
• Continue remediation • Collect impact metrics • Prepare preliminary analysis |
IT / CISO Risk Management |
| T+72h |
• Submit interim report • Include all quantified impacts |
Compliance |
| T+72h to T+1 month |
• Finalize RCA (Root Cause Analysis) • Define remediation plan • Calculate total costs |
IT / Risk / Finance |
| T+1 month |
• Submit final report • Close incident • Archive documentation |
Compliance Archives |
Our experts can guide your institution through DORA compliance, from gap analysis to full implementation.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.