DORA RTS on Incident Reporting

Initial notifications as referred to in Article 19(4), point (a), of Regulation (EU) 2022/2554 shall contain at least all of the following specific information:

1. (a)
   the incident reference code assigned by the financial entity;
2. (b)
   the date of detection, time of detection, and classification of the incident pursuant to Article 8 of Commission Delegated Regulation (EU) 2024/1772;
3. (c)
   a description of the ICT-related incident;
4. (d)
   the criteria, laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772, on the basis of which the financial entity classified the ICT-related incident as major;
5. (e)
   the Members States that are impacted by the ICT-related incident;
6. (f)
   information on how the ICT-related incident was discovered;
7. (g)
   where available, information about the origin of the ICT-related incident;
8. (h)
   information about whether the financial entity has activated a business continuity plan;
9. (i)
   where applicable, information about the reclassification of the ICT-related incident from major to non-major;
10. (j)
    where available, any other relevant information.