Classification of ICT-related incidents (DORA)
The grid in Delegated Regulation (EU) 2024/1772 that determines when an ICT-related incident (ICT: information and communication technology) at a financial entity becomes major under DORA and triggers mandatory reports to the competent authority.
The classification of ICT-related incidents (ICT: information and communication technology) is the grid that determines when an incident at a financial entity becomes major under DORA and must be reported to the competent authority. Delegated Regulation (EU) 2024/1772, adopted on March 13, 2024 and published in the Official Journal on June 25, 2024, implements Article 18 of Regulation (EU) 2022/2554 (DORA). It sets the criteria and thresholds that make an ICT-related incident major, and therefore reportable under Article 19. The entry gate is impact on critical services. Once through that gate, the incident is major in two cases: a successful, malicious and unauthorized access to network and information systems that may result in data losses; or materiality thresholds met on at least two other criteria. Article 9 puts numbers on those thresholds. Clients, financial counterparts and transactions: more than 10% of the clients using the affected service, or more than 100,000 clients. Geographical spread: an impact in two or more Member States. Economic impact: costs and losses that exceed, or are likely to exceed, EUR 100,000. Duration and service downtime: an incident lasting more than 24 hours, or more than two hours of downtime for a service supporting a critical or important function. Reputation, data losses and criticality of services are assessed on qualitative facts the text lists. For the underwriter, the economic threshold is the one that surprises. A hundred thousand euros is one week of incident response vendor time plus two days of business interruption: an incident that stays inside the policy retention can already be major for the supervisor. Classification also starts the four-hour clock, and the triage work of the first hours (lawyers, vendor, crisis cell) is a cost the response costs section covers or not, depending on whether the wording reaches regulatory obligations beyond personal data. At claim time, the amounts reported to the authority and the amounts claimed from the carrier get compared; a gap needs an explanation. One caveat: classification remains the entity's own judgment, which the authority can challenge, and an incident first rated major can be reclassified in a later report.
Textbook case: a fictional online bank has 800,000 clients. An outage blocks card payments for three hours; 60,000 clients are affected, or 7.5%, under both 10% and 100,000: no client threshold met. Three hours of downtime on a critical service exceeds two hours: first threshold. Costs of EUR 90,000 in vendors and EUR 50,000 in goodwill gestures total EUR 140,000, above EUR 100,000: second threshold. Critical service hit and two thresholds met, the incident is major. With a EUR 150,000 cyber retention, the carrier pays nothing.
Delegated Regulation 2024/1772, DORA classification RTS, major ICT-related incident, DORA materiality thresholds, DORA incident classification criteria, major incident test DORA
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.