[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F19":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","19","Article 19","Reporting of major ICT-related incidents and voluntary notification of significant cyber threats",0,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Financial entities must report major ICT-related incidents to their competent authority using an initial notification, an intermediate report and a final report. They may voluntarily notify significant cyber threats when they consider them relevant to the financial system, users or clients.\n\n**In practice.** Timelines and templates are set in technical standards: broadly, the initial notification is due within hours of classifying an incident as major and no later than 24 hours after becoming aware of it, the intermediate report within 72 hours of the initial notification, and the final report within one month of the latest intermediate report. Where an incident affects clients' financial interests, they must be informed without undue delay along with mitigation measures. Reporting can be outsourced to a third party, but responsibility remains with the entity. Evidence includes report submissions, timestamps and the decision trail.\n\n**Common gaps.** Common gaps are slow classification that delays the reporting clock, inconsistent data between reports, and no process for informing clients.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_19","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]