Is this incident major under DORA?
Answer three questions and get the classification with its legal basis, plus the exact times your initial, intermediate and final reports are due. Nothing you enter leaves your browser.
Know about a vendor outage before your clients do
Upload your ICT vendor list. We map each vendor's hosting, DNS and CDN, check the critical endpoints every five minutes and open an incident file with timestamps, criteria and a draft notification as soon as something fails.
How the classification works
An ICT-related incident is major when it affects critical services and either a successful malicious unauthorised access may lead to data losses, or the thresholds of at least two other criteria are met (Art. 8 of Delegated Regulation (EU) 2024/1772).
Critical services are affected when the incident touches ICT services that support critical or important functions, financial services that need authorisation, registration or supervision, or when a successful malicious unauthorised access happened (Art. 6).
The six criteria and their thresholds are set in Art. 9: clients, financial counterparts and transactions (more than 10% of clients, more than 100,000 clients, more than 30% of counterparts, more than 10% of daily transactions by number or value, or any relevant client), reputation, duration (more than 24 hours, or more than 2 hours of downtime for critical or important functions), two or more member states, data losses, and economic impact above €100,000.
Reporting deadlines
- Initial notification
- Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. If classification happens later than that, 4 hours after classification.
- Intermediate report
- Within 72 hours of the initial notification. Update it without undue delay once regular activities are recovered.
- Final report
- Within 1 month of the latest updated intermediate report.
Deadlines that fall on a weekend or public holiday may move to noon of the next working day. This does not apply to the initial notification and intermediate report of credit institutions, central counterparties, trading venue operators and entities that are essential or important under NIS2 (Art. 5 of Delegated Regulation (EU) 2025/301).
Questions
What is a major ICT-related incident under DORA?
One that affects critical services and either involves a successful malicious unauthorised access that may result in data losses, or meets the thresholds of at least two of the six criteria in Art. 9 of Delegated Regulation (EU) 2024/1772.
When do I have to send the initial notification?
Within 4 hours of classifying the incident as major and at the latest 24 hours after becoming aware of it. If you classify it later than 24 hours after becoming aware, the 4 hours run from classification.
Can I use estimates?
Yes. Where the actual figures are not known yet, the regulation allows estimates based on other available data. Reassess as the figures firm up.
What about recurring incidents?
Incidents that are not major on their own but share the same apparent root cause, occur at least twice within 6 months and together meet the criteria are classified as one major incident (Art. 8(2)).
Where do Austrian entities report?
To the FMA, through its Incoming Platform, using the reporting templates published by the European Supervisory Authorities.