Free DORA Incident Classification Tool (beta version)

1. Does the incident impact critical services?

Assess if the incident:

a) affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;
b) affects or has affected financial services that require authorisation, registration or that are supervised by competent authorities; or
c) represents a successful, malicious and unauthorised access to the network and information systems of the financial entity.

2. Is unauthorised access to network and information systems identified, which may result in data losses?

3a. Clients, financial counterparts and transactions - does the incident meet any of the following conditions?

a) the number of affected clients is higher than 10% of all clients using the affected service; or
b) the number of affected clients is higher than 100,000 clients using the affected service; or
c) the number of affected financial counterparts is higher than 30% of all financial counterparts carrying out activities related to the provision of the affected service; or
d) the number of affected transactions is higher than 10% of the daily average number of transactions carried out by the financial entity related to the affected service; or
e) the amount of affected transactions is higher than 10% of the daily average value of transactions carried out by the financial entity related to the affected service; or
f) any identified impact on clients or financial counterparts which have been identified as relevant as an outcome of the assessment made by the financial entity under Article 1(3).

3b. Data losses - does the incident have any impact on the availability, authenticity, integrity or confidentiality of data, which has or will have an adverse impact on the implementation of the business objectives of the Financial Entity or on meeting regulatory requirements?

1. availability of data – data on demand rendered temporarily or permanently inaccessible or unusable;
2. authenticity of data – compromised trustworthiness of the source of data;
3. integrity of data – data inaccurate or incomplete due to non-authorised modification;
4. confidentiality of data – data being accessed by or disclosed to an unauthorised party or system.

3c. Reputational impact - Is here any reputational impact?

Reputational impact evidenced by any of the below:
a) incident reflected in the media; or
b) received repetitive complaints; or
c) inability to meet regulatory requirements; or
d) likely loss of clients or financial counterparts with a material impact on FE’s business. Level of visibility of the incident to be taken into account.

3d. Duration and Service Downtime - is the a) incident duration longer than 24 hours; or b) service downtime longer than 2 hours for ICT services that support critical or important functions

1. Duration measured from the moment an incident occurs or is detected, until it is resolved. (estimate if not yet known)
2. Service downtime measured from the moment service fully/partially unavailable/delayed to clients, financial counterparts or other internal or external users, until activities are restored to the same level before the incident.

3e. Geographical Spread - any impact of the incident identified in the territories of at least two EU Member States?

Assess significant impact of the incident in other EU Member States on:
a) clients or financial counterparts;
b) branches of the FE or other group financial entities;
c) Financial market infrastructures or third-party providers that may affect other FEs.

3f. Economic Impact - do the costs and losses incurred by the Financial Entity exceed or are likely to exceed €100,000 (can be based on estimates where actuals cannot be determined)?

Types of direct and indirect incurred costs:
a) expropriated funds or financial assets liability, including theft;
b) replacement or relocation costs;
c) staff costs;
d) contract non-compliance fees;
e) customer redress and compensation costs;
f) forgone revenues;
g) communication costs;
h) advisory costs. (based on available data at the time of reporting)