Chapter IIIICT-related incident management, classification and reporting
- Article 17ICT-related incident management process
1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. 2. Financial entities shall record all ICT-related incidents…
- Article 18Classification of ICT-related incidents and cyber threats
1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria: (a) the number and/or relevance of clients or financial counterparts affected…
- Article 19Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where…
- Article 20Harmonisation of reporting content and templates
The ESAs, through the Joint Committee, and in consultation with ENISA and the ECB, shall develop: (a) common draft regulatory technical standards in order to: (i) establish the…
- Article 21Centralisation of reporting of major ICT-related incidents
1. The ESAs, through the Joint Committee, and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further centralisation of incident…
- Article 22Supervisory feedback
1. Without prejudice to the technical input, advice or remedies and subsequent follow-up which may be provided, where applicable, in accordance with national law, by the CSIRTs under…
- Article 23Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit…
https://dora.digiphile.law/chapter/chapter-III.html
Text as at 2 November 2026.
This is an unofficial convenience version of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.