Major ICT incidents must be classified with set criteria and reported to the supervisor in an initial, intermediate and final report. Classification looks at clients affected, duration, geographic spread, data losses and economic impact. The criteria are detailed in technical standards.
Why it matters
For DORA, incident reporting is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Build the classification criteria into your incident process
- Prepare the reporting templates in advance
- Log all ICT incidents, not only major ones
Where to start
Running a past incident through the classification is a quick way to test the process. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.