DORA Major ICT Incident Reporting: Classification, 4-Hour / 72-Hour / 1-Month Deadlines

The Three Primary Deadlines

Classification First

Clocks for the initial notification run from classification as major (with the hard awareness backstop). Document classification criteria, who can declare “major,” and how secondary/significant incidents escalate. RTS classification criteria and national templates apply — train the SOC and crisis team together.

Operational Prerequisites

• 24/7 awareness path so the 24-hour backstop is realistic
• Pre-approved notification templates and authority contacts
• Detection evidence under Article 10 — logging & SIEM
• Coordination with GDPR / NIS2 clocks when those regimes also apply

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is the initial notification really 4 hours?

Yes for the post-classification clock: initial notification within 4 hours after classifying the incident as major, and in any case no later than 24 hours from becoming aware — follow Delegated Regulation (EU) 2025/301 and your competent authority’s channel.

What is the intermediate deadline?

An intermediate report within 72 hours of the initial notification.

When is the final report due?

Within one month of the submission of the last intermediate report (or as specified when no intermediate report applies). Confirm the RTS wording your authority expects.

Related DORA Resources

Hub · Pillars · ThreatHawk · CSA