Major incident reporting

Before DORA, reporting of information technology incidents depended on the sector, the country and sometimes the supervisor's mood, which made any aggregate view of European operational risk impossible. The regulation harmonizes three things. The classification criteria first: number of clients affected, duration and service downtime, geographic spread, data losses, criticality of services affected, economic impact, with an incident being major when it affects critical services and either meets the malicious access with data loss threshold or at least two of the other materiality thresholds. The procedure next, in three stages: a very fast initial notification after classification, an intermediate report when normal activity resumes or when the situation changes materially, then a final report documenting root causes and corrective measures. The content last, through standardized forms. Two effects follow. The internal chain must be able to classify an incident within hours, which presupposes preset criteria rather than a crisis deliberation. And the regime coexists with GDPR data breach notification and with NIS2 obligations, which share neither thresholds nor recipients, so one incident often triggers several distinct filings.