DORA Incident Response Planning
DORA incident response planning establishes the processes a financial entity uses to detect, manage, classify, and report major ICT-related incidents under Articles 17–23. A tested plan is what lets an entity meet DORA's strict reporting deadlines under pressure.
What the plan must enable
The plan defines detection and triage, the criteria that make an incident major, escalation paths, and the three-stage reporting flow (initial, intermediate, and final report) to the competent authority. Use our incident classifier to check whether a given incident is reportable.
Testing and roles
Response plans should be exercised regularly and integrated with the ICT risk-management framework and business-continuity arrangements, with clear roles across ICT, compliance, and the management body.
Where incident reporting infrastructure is heading
Article 21 requires the ESAs to look beyond today's reporting flow and assess whether incident reports should ultimately move through a single EU channel rather than each entity notifying its own competent authority. In a joint report submitted to the European Parliament, the Council, and the Commission in January 2025, the ESAs concluded that further centralisation, including a single EU hub for major-incident reports, is feasible and would bring benefits such as more consistent data and less duplicated effort across authorities, but also raises risks from concentrating sensitive incident data in one place that a future design would need to control for. The report set out three models, from a lightly modified version of today's flow through to full centralisation, and found only the lightest-touch option realistic in the short term, within three years of DORA's January 2025 application date. For entities building or refreshing a response plan now, the practical takeaway is that the three-stage reporting flow described above is the process to design against today; a more centralised EU channel is a medium-term direction, not a near-term change to plan for. The same centralisation question resurfaced in the European Commission's November 2025 Digital Omnibus package, which proposes routing DORA incident notifications through a shared EU-wide portal alongside NIS2 and other regimes, see our analysis of that proposal for where it currently stands.
Frequently asked questions
What are DORA's incident reporting deadlines?
Major incidents follow a three-stage flow, an initial notification, an intermediate report, and a final report, with deadlines set in the RTS/ITS on incident reporting.
How do I know if an incident is reportable?
Assess it against the classification criteria (clients affected, duration, data loss, economic impact). Our classifier gives an instant estimate.
Does DORA require incident response testing?
DORA requires business-continuity and response plans to be maintained and tested as part of the ICT risk-management framework.
Will DORA incident reports eventually go to a single EU authority instead of national regulators?
Possibly, but not soon. A January 2025 ESAs report found a single EU hub for major-incident reporting feasible and beneficial, but concluded only a lightly modified version of today's national-authority reporting flow is realistic within DORA's first three years.