ICT Incident Classification and Reporting
A plain guide to how DORA incident classification and reporting works: restoring the service, deciding what counts as major, and keeping a record that stands up later.
Line 06: Incident management and reporting
Classifying an ICT-related incident, managing it while the service is down, and reporting it to the right authority in the right phase.
The line guide
Working guides on this line
Classifying an Incident by Impact
How to judge an ICT incident by its impact on services and customers, rather than by the size of the technical fault, and how to keep that judgement consistent.
Incident Communication to Customers
How to tell customers about an ICT incident in plain language: what to say early, how to update as facts change, and what to avoid saying before it is known.
Incident Communication to the Board
What the board needs to hear during and after a major ICT incident, how that differs from the technical account, and how board reporting supports oversight without slowing the response.
Incident Logs and Evidence
What an incident log should capture, how evidence is preserved during a live incident, and why a log written at the time is worth more than a reconstruction afterwards.
Incident Reporting Phases Under DORA
The phases of DORA incident reporting explained in order: what each phase is for, what it should contain, and how later phases correct or complete earlier ones.
Incident Reporting Timelines Explained
How DORA reporting timelines work in practice: why phases have their own timing, what to do when facts are still emerging, and how to avoid delaying an early report until it is perfect.
Incident Reporting to Multiple Authorities
When a major ICT incident must be reported to more than one authority, how to keep those reports consistent, and how to coordinate when different authorities ask different questions.
Incident Response Teams and Roles
The roles that make up an incident response under DORA: who leads, who owns the service, who keeps the log, and how those roles work together during a live incident.
Incident Severity and Escalation
How severity levels and escalation routes work together during an ICT incident, when an incident should move up a level, and who decides that it moves.
Incidents Caused by Third Parties
When an ICT incident starts with a provider, what stays the firm's responsibility, how to get information from the provider during the incident, and how to report an incident you did not cause.
Learning from Incidents Without Blame
How to run an incident review that finds real causes and real fixes, without turning the review into a search for someone to blame, and why blame free review finds more.
Minor Incidents and Near Misses
Why minor incidents and near misses deserve attention under DORA, how to record them without drowning the team in paperwork, and what patterns they reveal before a major incident.
Reporting to Competent Authorities
Who competent authorities are in DORA incident reporting, how a firm finds the right route, and what a report to an authority should and should not contain.
What Counts as a Major ICT Incident
What makes an ICT incident major under DORA, how the classification criteria work in practice, and why the service effect matters more than the technical fault alone.