DORA incident reporting: the four-hour, 72-hour and one-month clocks

DORA splits incident handling into two questions. First, is this a major incident? Second, if it is, you report it to your competent authority on a staged timeline. Getting the first question right matters, because it starts the clocks, and the clocks are tight.

When an incident is major

The classification criteria live in RTS (EU) 2024/1772. In plain terms, an incident is major when it affects a critical or important service and either meets at least two of the materiality criteria, or involves successful malicious unauthorised access to your network and information systems.

The materiality criteria cover the clients, counterparts and transactions affected, reputational impact, how long the incident lasted and how long a critical service was down, whether it spread across two or more Member States, data losses, and the economic cost. The quantitative thresholds matter: more than 10 percent or 100,000 clients, more than 30 percent of counterparts, more than 10 percent of transactions, more than 24 hours of duration or 2 hours of downtime, two or more Member States, or costs above 100,000 euro.

The three staged reports

• Initial notification: as early as possible once you classify the incident as major, within four hours of that classification and no later than 24 hours after you became aware.
• Intermediate report: within 72 hours of the initial notification, updating what you know and what you are doing.
• Final report: no later than one month after the initial notification, with root cause and the lessons learned.

Why teams miss them

The clocks are short and they start during the worst part of an incident, when everyone is busy fixing the problem rather than filling in a report. The teams that hit the deadlines are the ones who decided classification in advance and let a tool run the timers.

Compliance One classifies the incident against the criteria as you enter the facts, tells you immediately whether it is major, and then starts the initial, intermediate and final clocks with reminders before each one. You are reporting, not recalculating, when it counts.

A missed reporting deadline is a second incident, and this one is entirely on you.