DORA Incident Reporting: Building the Pipeline from Detection to Regulatory Submission

DORA Article 19 requires financial entities to report major ICT-related incidents to their competent authority. The reporting timeline is tight: initial notification within 4 hours of classification, intermediate report within 72 hours, final report within one month. Building infrastructure that meets these deadlines consistently requires automation.

Incident Classification Infrastructure

DORA defines criteria for "major" incidents based on:

• Number of clients/counterparts affected
• Duration of the incident
• Geographical spread
• Data losses (availability, authenticity, integrity, confidentiality)
• Economic impact
• Criticality of affected services

Your infrastructure must automatically assess incoming incidents against these criteria. Integrate classification logic into your SIEM/SOAR platform so that major incidents are flagged immediately — not after a human reviews a queue of alerts.

The Reporting Pipeline

1. Detection → Classification (automated) — SIEM alert triggers classification engine. Major incident? Start the clock
2. Initial notification (4 hours) — Pre-populated report template with incident metadata, affected systems, initial impact assessment. Routed to CISO for approval, then submitted
3. Investigation support — Automated forensic data collection: logs, network captures, affected asset inventory, timeline reconstruction
4. Intermediate report (72 hours) — Updated impact assessment, root cause analysis progress, remediation actions taken
5. Final report (1 month) — Complete root cause analysis, total impact quantification, lessons learned, remediation completion evidence

Integration with Other Reporting Obligations

A single incident may trigger multiple reporting obligations: DORA (competent authority), GDPR (DPA, if personal data involved), CRA (ENISA, if product vulnerability involved), NIS2 (CSIRT). Your reporting infrastructure should route to all applicable channels from a single incident record.