← Back to all briefings
Cybersecurity 6 min read Published Updated Credibility 94/100

Cybersecurity Governance — DORA

DORA went live January 17, 2025, and financial entities need to classify and report ICT incidents using the ESA's new technical standards. Time to build your decision trees and reporting workflows.

Kodi C.

Editor & Research Lead

Reviewed for accuracy by Kodi C.

Cybersecurity pillar illustration for Zeph Tech briefings
Cybersecurity threat, control, and response briefings

The EU Digital Operational Resilience Act (DORA) has applied since 17 January 2025, and financial entities must now classify ICT-related incidents using the methodology set out in the European Supervisory Authorities’ (ESAs) joint Regulatory Technical Standards (RTS) on incident classification and reporting. The RTS—delivered under Articles 18 and 20—introduces impact thresholds, scoring criteria, and reporting timelines for major incidents and significant cyber threats. this analysis equips compliance, operational resilience, cybersecurity, and privacy leaders with a full playbook for implementing the classification framework, honoring universal opt-out commitments during communications and analytics, and producing evidence packages that withstand competent authority scrutiny.

Regulatory foundations and scope

  • Applicable entities. DORA covers credit institutions, payment institutions, e-money institutions, investment firms, insurance and reinsurance doings, crypto-asset service providers, and ICT third-party service providers designated as critical.
  • Classification methodology. The RTS defines quantitative and qualitative indicators across service downtime, number of clients affected, data loss, economic impact, reputational effects, and geographical spread. Incidents meeting certain thresholds must be reported within four stages (initial, intermediate, final, and root-cause analysis) through the single EU hub.
  • Significant cyber threats. Entities must also report cyber threats that could materialize into major incidents, applying similar impact criteria and providing preventive measures.
  • Interaction with other laws. DORA reporting may overlap with PSD2, NIS2, GDPR breach notifications, and sector-specific regimes. Governance teams must align timelines and universal opt-out protections across all notifications.

Governance and accountability

  • Assign the chief risk officer or chief operational resilience officer as executive sponsor for DORA incident classification, with deputies from cybersecurity, IT operations, business continuity, privacy, and legal. set up a resilience council that meets weekly during the first half of 2025.
  • Update the ICT risk management framework to incorporate DORA classification criteria, escalation paths, opt-out considerations, and reporting obligations. Map each control to responsible owners and testing cadences.
  • Embed oversight at board level: ensure the management body receives quarterly dashboards on incidents, classification accuracy, opt-out adherence, and remediation progress.
  • Coordinate with ICT third-party providers to integrate DORA obligations into contracts, including data-sharing clauses, opt-out stewardship, and evidence handover timelines.

Universal opt-out considerations during incident handling

  • Maintain a registry of clients, users, and employees who have exercised universal opt-out rights for marketing or analytics. Ensure incident notification systems respect these preferences while still delivering mandatory regulatory communications via permitted channels.
  • When collecting forensic logs or behavioral analytics during incident triage, filter out or anonymise data from opt-out individuals unless processing is strictly necessary for security obligations permitted under GDPR/LGPD. Document lawful basis assessments.
  • Provide opt-out reaffirmation options in post-incident communications, allowing affected individuals to control future data usage while receiving required resilience updates.
  • Record how opt-out safeguards were maintained during the incident lifecycle in after-action reports and evidence logs.

Implementing the classification workflow

  • Develop decision trees aligned to the RTS, incorporating impact scoring tables, service criticality tiers, and business context. Automate initial scoring within incident management platforms (for example, ServiceNow, Jira) while allowing manual overrides with documented justification.
  • Maintain a current catalog of critical and important functions, mapped to ICT assets, service owners, customer segments, and opt-out registries. Ensure incident classification references this catalog for accurate impact assessments.
  • Configure tooling to capture metrics such as downtime duration, number of non-availability transactions, volume of personal data records affected, and financial losses. Validate data sources for accuracy and ensure they do not override opt-out protections.
  • Document classification decisions, rationale, scoring inputs, and approvals. Store artifacts in an immutable evidence repository accessible to internal audit and supervisors.

Reporting mechanics and timelines

  • Integrate DORA reporting templates into incident management systems. Pre-populate fields with organizational information, critical service definitions, and opt-out stewardship statements to accelerate submission cycles.
  • set up a 4-2-4 timeline discipline: initial notification within four hours of classification as major, intermediate reports within two business days, final reports within 20 business days, and root-cause analyzes within one month (unless extension approved). Maintain checklists ensuring opt-out compliance at each stage.
  • Coordinate cross-regime reporting: align DORA notifications with GDPR breach reports, PSD2 incident notices, and national competent authority requirements. Use a master reporting calendar and evidence pack to avoid inconsistent disclosures.
  • Track acknowledgments and feedback from competent authorities. Update playbooks when regulators request additional data or highlight recurring weaknesses.

Evidence management and assurance

  • Build an evidence library covering incident timelines, communications, forensic outputs, opt-out protection steps, recovery milestones, and lessons learned. Tag artifacts by incident ID and classification level.
  • Implement independent assurance reviews at least annually to test classification accuracy, data quality, opt-out adherence, and reporting timeliness. Document findings, remediation tasks, and responsible owners.
  • Maintain audit trails for any manual adjustments to impact scores or reporting decisions, including risk acceptance memos approved by senior management.
  • Use security information and event management (SIEM) and SOAR platforms to create tamper-evident logs of detection, response, and communication events.

Training and change management

  • Deliver role-based training for incident responders, business continuity teams, communications staff, and executives. Cover classification rules, universal opt-out obligations, reporting timelines, and evidence expectations.
  • Run tabletop exercises featuring cross-border incidents, third-party outages, ransomware, and data exfiltration. Include opt-out scenarios where certain customers decline marketing communications yet must receive regulatory notices.
  • Embed lessons learned into playbooks, checklists, and automation scripts. Track training completion and opt-out preferences for participants.
  • Provide ongoing knowledge updates as ESAs release FAQs or as the EU hub publishes technical specifications.

Third-party integration

  • Require critical ICT providers to adopt DORA-compatible classification models, share incident metrics rapidly, and preserve opt-out commitments for data they handle on your behalf.
  • Include contractual clauses for data segregation, evidence delivery, breach notification timelines, and participation in joint post-incident reviews. Track compliance via vendor scorecards.
  • Conduct assurance testing of providers’ logging, monitoring, and reporting capabilities, focusing on how they respect opt-out flags while furnishing necessary incident data.

Metrics and continuous improvement

  • Monitor KPIs: time to classify, accuracy of initial scoring versus final assessment, reporting timeliness, opt-out breach incidents, remediation cycle time, and recurrence of root causes.
  • Produce quarterly resilience dashboards for the management body and competent authorities summarizing incident trends, opt-out protection performance, and progress on remediation.
  • Benchmark against industry peers and supervisory expectations, using ESA feedback, financial authority speeches, and sector-specific information-sharing groups.

90-day setup roadmap

  1. Days 0-30: formalize governance, align policies with RTS criteria, configure incident tooling, and conduct data-mapping exercises covering opt-out registries.
  2. Days 31-60: Execute training, run tabletop exercises, finalize automation workflows, and sign updated contracts with critical ICT providers.
  3. Days 61-90: Perform live-fire drills, validate evidence repositories, submit practice reports through the EU hub (where supported), and present readiness updates to the board and competent authority relationship managers.

This brief steers financial institutions through DORA’s incident classification regime by uniting operational resilience, universal opt-out stewardship, and evidence integrity that withstands supervisory examinations.

Related articles

Curated signals from the same pillar or overlapping topics.

Continue in the Cybersecurity pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • Cybersecurity Operations Playbook

    Use our research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.

  • Network Security Fundamentals Explained Practically

    A practitioner-focused guide to network security fundamentals covering firewalls, segmentation, IDS/IPS, DNS security, VPNs, wireless security, zero trust architecture, and traffic…

  • Small Business Cybersecurity Survival Checklist

    A budget-conscious cybersecurity checklist built specifically for small businesses. This guide covers foundational security policies, network hardening, employee training, phishing…

Coverage intelligence

Published
Coverage pillar
Cybersecurity
Source credibility
94/100 — high confidence
Topics
DORA · Incident reporting · EU financial regulation · Operational resilience
Sources cited
3 sources (eba.europa.eu, esma.europa.eu)
Reading time
6 min

References

  1. ESAs: Final report on DORA incident classification criteria — eba.europa.eu
  2. ESAs Q&A on DORA incident reporting (February 2025) — eba.europa.eu
  3. ESAs press release on DORA technical standards — esma.europa.eu
  • DORA
  • Incident reporting
  • EU financial regulation
  • Operational resilience
Back to curated briefings

Comments

Community

We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.

    Share your perspective

    Submissions showing "Awaiting moderation" are in review. Spam, low-effort posts, or unverifiable claims will be rejected. We verify submissions with the email you provide, and we never publish or sell that address.

    Verification

    Complete the CAPTCHA to submit.