What it asks for. Article 17 requires financial entities to define, establish and implement an ICT related incident management process to detect, manage and notify incidents. All ICT related incidents and significant cyber threats must be recorded, with early warning indicators and procedures to classify incidents.
In practice. The entity has documented procedures covering detection, logging, classification according to DORA criteria, escalation, roles and communication to staff, clients and authorities. Incidents are tracked to resolution and root cause, and major incidents are escalated to senior management. Evidence includes procedures, incident registers, classification records and management reports.
Common gaps. Classification against DORA criteria is often slow or inconsistent, delaying reporting of major incidents. Significant cyber threats may not be recorded at all.