RTS/ITS on Major Incident & Cyber Threat Reporting
Final Report – Draft Regulatory Technical Standards on the content of the notification and reports for major incidents and significant cyber threats and determining the time limits for reporting major incidents and Draft Implementing Technical Standards on the standard forms, templates and procedures for financial entities to report a major incident and to notify a significant cyber threat
Abstract
Final draft Regulatory and Implementing Technical Standards under DORA specifying harmonised requirements for reporting major ICT-related incidents and notifying significant cyber threats. Defines report content, standard templates, procedures, and strict timelines for initial, intermediate, and final reports to competent authorities, aiming to streamline and standardise incident reporting across EU financial entities.
Key Takeaways
- Specifies mandatory content and structured templates for initial, intermediate, and final incident reports.
- Sets strict reporting timelines: initial notification within 4 hours of classification (max 24 hours from awareness), intermediate within 72 hours, and final within one month.
- Introduces harmonised reporting forms and data fields to ensure consistent supervisory oversight across the EU.
- Reduces reporting burden by streamlining required fields and enabling proportionality for smaller entities.
- Allows aggregated reporting by ICT third-party providers or groups under defined conditions.
- Defines voluntary notification framework for significant cyber threats.
Keywords
Need DORA-Aligned AI Architecture?
We build AI systems that satisfy DORA requirements from day one. Audit trails, governance, exit readiness - built in, not bolted on.
Schedule Architecture Reviewviktor@intellectumlab.com | Response within 24 hours