Efficient Capture, Analysis, and Reporting of ICT Incidents According to DORA Requirements
DORA mandates reporting of major ICT-related incidents within strict timelines: initial notification within 4 hours of classification, intermediate report within 72 hours, and a final report within one month.
Since January 2025, DORA incident reporting obligations apply to all financial entities. Major ICT-related incidents must be classified against defined thresholds and reported to competent authorities within strict deadlines: initial notification within 4 hours of classification, an intermediate report within 72 hours, and a final report within one month. Our automated reporting system monitors deadlines, generates authority-compliant reports, and maintains a complete audit trail.
Our DORA Incident Reporting System includes all necessary components for effective capture, analysis, and reporting of ICT incidents according to DORA requirements. We support you in implementing a customized solution that considers your specific business requirements.
2 service modules
Bookable individually or as an end-to-end programme.
Development of a structured framework for classifying and assessing ICT incidents according to DORA requirements.
Design of efficient workflows for timely detection, escalation, and reporting of ICT incidents.
5 phases
We support you in developing and implementing a customized incident reporting system that meets DORA requirements while being optimally integrated into your existing processes.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Implementing a DORA-compliant incident reporting system is a complex undertaking that requires both technical and organizational expertise. Our team supports financial institutions in designing this process efficiently while creating value for overall risk management.
An effective incident reporting system goes beyond pure compliance. It enables valuable insights into operational risks and promotes continuous improvement of your organization's digital resilience.
6 QUESTIONS, BRIEFLY ANSWERED
Incidents classified as major are subject to a staged reporting obligation: an initial notification within a few hours of detection, an intermediate report with an updated assessment, and a final report after the analysis is complete. Exact deadlines are set out in the regulatory technical standards and should be checked there in detail, since they can differ from other reporting obligations.
Classification follows defined thresholds, such as number of customers affected, duration of disruption, economic impact, or geographic spread. These criteria are detailed in the regulatory technical standards; an incident below those thresholds isn't subject to DORA's reporting obligation but should still be documented internally.
The initial notification typically includes the time of detection, an early assessment of affected systems and customers, and immediate measures already taken. Since it's prepared under time pressure, it's normal for it not to include every detail yet; that's what the subsequent intermediate and final reports are for.
The initial notification informs the supervisor as quickly as possible that an incident has occurred, the intermediate report provides an updated picture as the situation becomes clearer, and the final report documents the complete root cause analysis and measures taken. Each stage has its own content requirements and deadline.
Useful systems automatically convert incident data from monitoring tools into a reportable format and track the status of each reporting stage, rather than requiring every report to be assembled manually from scratch. When selecting one, it's worth checking whether it directly supports the specific reporting formats of the relevant supervisory authority.
Reports go to the relevant national supervisory authority, in Germany typically BaFin, potentially supplemented by sector-specific reporting channels. For companies operating across borders, reporting obligations can apply in several member states simultaneously; this should be clarified in advance with the respective national authorities rather than discovered during an actual incident.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance