DORA-Art17-P1

ICT Incident Management Process Document COMMON

Comprehensive document defining the institution's ICT-related incident management process, including detection mechanisms, escalation procedures, roles and responsibilities, and communication protocols as required by DORA Article 17.

Formats: PDF
Evidence Class: incident-management-process
Availability: COMMON
Update Frequency: annual
Typical Author: CISO
Approval Chain: CISO → CRO → Board Risk Committee

Content Sections

Expected Fields

Common Quality Issues

Process not tested through simulation exercises
Escalation thresholds not quantified
Missing integration with third-party provider incident processes
Communication protocols do not cover regulatory notification timelines

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

PLAIN_TEXT — Inline Preview

ICT-RELATED INCIDENT MANAGEMENT PROCESS
Nordvik Bank AG
Document Reference: PROC-ICT-IM-2025-001
Version 3.1 | Effective Date: 10 February 2025
Process Owner: Chief Information Security Officer (CISO)
Review Cycle: Annual | Next Review: 10 February 2026
Classification: Internal — Restricted

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. PROCESS OVERVIEW

1.1 Purpose

This document defines the end-to-end process for managing ICT-related incidents at
Nordvik Bank AG ("the Bank"), from initial detection through resolution, reporting,
and post-incident review. The process is designed to ensure timely identification,
classification, escalation, and resolution of ICT incidents in compliance with
Regulation (EU) 2022/2554 (DORA), Article 17.

1.2 Scope

This process applies to all ICT-related incidents affecting:
  — Core banking systems and payment processing infrastructure
  — Customer-facing digital channels (internet banking, mobile banking, APIs)
  — Internal IT infrastructure and communication systems
  — Third-party ICT services supporting critical or important business functions
  — Data integrity and confidentiality events involving ICT systems

1.3 Regulatory Basis

  — DORA Article 17: ICT-related incident management process
  — DORA Article 18: Classification of ICT-related incidents
  — DORA Articles 19–20: Reporting of major ICT-related incidents
  — EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. INCIDENT DETECTION MECHANISMS

2.1 Automated Detection

The Bank operates the following automated detection capabilities:

  Detection Source              Tool                    Coverage
  ─────────────────────────────────────────────────────────────────────────────
  SIEM correlation              Splunk Enterprise 9.2   All production systems
  Endpoint detection            CrowdStrike Falcon      1,389 endpoints
  Network anomaly detection     Darktrace Enterprise    5 network segments
  Vulnerability scanning        Qualys VMDR             1,247 assets (weekly)
  Application monitoring        Dynatrace               12 critical applications
  Cloud security posture        AWS Security Hub         All AWS workloads

2.2 Manual Detection Channels

  — Service desk tickets flagged as potential ICT incidents
  — Reports from staff via the incident reporting hotline (+41 44 XXX XXXX)
  — Reports from staff via the dedicated email (ict-incident@nordvik-bank.example)
  — Alerts from third-party ICT service providers
  — Notifications from regulators, CERTs, or industry sharing communities
  — Customer complaints indicating potential ICT disruption

2.3 Detection SLAs

  Incident Severity    Target Detection Time
  ─────────────────────────────────────────────────────────────────────────────
  Critical             ≤ 15 minutes (automated alerting)
  High                 ≤ 30 minutes
  Medium               ≤ 2 hours
  Low                  ≤ 8 hours (next business day for off-hours)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. ESCALATION PROCEDURES

3.1 Escalation Matrix

  Severity     First Responder       Escalation Level 1      Escalation Level 2
  ─────────────────────────────────────────────────────────────────────────────
  Critical     SOC Analyst           CISO (immediate)        CRO + Board (1h)
  High         SOC Analyst           SOC Manager (15 min)    CISO (1h)
  Medium       SOC Analyst           SOC Manager (2h)        CISO (next day)
  Low          Service Desk          SOC Analyst (4h)        SOC Manager (next day)

3.2 Escalation Triggers

Automatic escalation is triggered when:
  — An incident is not acknowledged within the detection SLA
  — An incident is not contained within the containment SLA
  — An incident affects more than one critical business function
  — An incident involves confirmed data loss or data breach
  — An incident affects more than 10,000 customers
  — A third-party provider reports a major incident affecting Bank services

3.3 Regulatory Notification Triggers

The CISO shall initiate the regulatory notification process when an incident meets
the major incident thresholds defined in the Incident Classification Taxonomy
(REF: TAX-ICT-INC-2025-001), specifically:
  — Initial notification to FINMA: within 4 hours of classification as major
  — Intermediate report: within 72 hours
  — Final report: within 1 month of resolution

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. ROLES AND RESPONSIBILITIES

Role                              Responsibilities
─────────────────────────────────────────────────────────────────────────────────
SOC Analyst                       First-line detection, triage, initial response
SOC Manager                       Coordinate response; manage SOC resources
Incident Response Team Lead       Lead major incident response; coordinate teams
CISO                              Approve regulatory notifications; strategic decisions
CRO                               Oversee risk implications; Board communication
IT Infrastructure Manager         Infrastructure containment and recovery actions
Application Support Lead          Application-level diagnosis and recovery
Communications Manager            Internal and external communications
Legal Counsel                     Regulatory and legal implications assessment
Third-Party Liaison               Coordinate with affected service providers

4.1 Incident Response Team Composition

The Incident Response Team (IRT) is activated for all High and Critical incidents:
  — Core team: SOC Manager, IRT Lead, IT Infrastructure Manager, Application Lead
  — Extended team (as needed): CISO, Legal, Communications, Business Line Heads
  — Third-party support: Engaged per contractual incident response provisions

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

5. COMMUNICATION PROTOCOLS

5.1 Internal Communication

  Audience                  Channel                  Frequency
  ─────────────────────────────────────────────────────────────────────────────
  IRT members               Dedicated Slack channel   Real-time during incident
  Senior management         Email + phone bridge      Hourly for Critical
  All staff                 Intranet banner           As needed
  Board Risk Committee      Email briefing            Within 4h for Critical

5.2 External Communication

  Audience                  Channel                  Trigger
  ─────────────────────────────────────────────────────────────────────────────
  Competent authority       Regulatory portal         Major incident thresholds
  Affected customers        Email / SMS / app push    Service disruption > 1h
  Media                     Press statement           Public-facing disruption
  Third-party providers     Contractual channels      Shared infrastructure impact

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

6. INCIDENT LIFECYCLE STAGES

  Stage 1: Detection and Triage
    — Automated alert or manual report received
    — SOC Analyst performs initial triage within 15 minutes
    — Incident logged in ITSM tool (ServiceNow) with unique incident ID

  Stage 2: Classification
    — Severity assigned per Incident Classification Taxonomy
    — Major incident determination per DORA Article 18 criteria
    — Escalation initiated per escalation matrix

  Stage 3: Containment
    — Immediate containment actions to limit impact
    — Evidence preservation for root cause analysis
    — Affected systems isolated if necessary

  Stage 4: Eradication and Recovery
    — Root cause identified and eliminated
    — Systems restored from known-good state
    — Verification testing before service restoration

  Stage 5: Post-Incident Activities
    — Post-incident review within 10 business days
    — Root cause analysis report within 20 business days
    — Lessons learned documented and shared
    — ICT risk register updated if new risks identified

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

7. INTEGRATION WITH BUSINESS CONTINUITY

7.1 BCP Activation Criteria

The ICT incident management process integrates with the Business Continuity Plan
(BCP) when:
  — A Critical incident is expected to exceed the Recovery Time Objective (RTO)
  — Multiple critical business functions are simultaneously affected
  — The incident requires activation of disaster recovery procedures

7.2 Handover Protocol

When BCP activation is required, the IRT Lead formally hands over coordination to
the Business Continuity Manager, while the IRT continues technical resolution
activities. Both teams maintain a shared communication channel.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

8. PROCESS METRICS AND REPORTING

  Metric                              Target          Reporting Frequency
  ─────────────────────────────────────────────────────────────────────────────
  Mean Time to Detect (MTTD)          ≤ 30 min        Monthly
  Mean Time to Respond (MTTR)         ≤ 4 hours       Monthly
  Escalation SLA compliance           ≥ 95%           Monthly
  Regulatory notification compliance  100%            Per incident
  Post-incident review completion     100%            Quarterly
  Simulation exercise frequency       ≥ 2 per year    Annual

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Document History:
  v3.1  10 Feb 2025  Updated for DORA Article 17 compliance; added regulatory
                     notification triggers and major incident thresholds
  v3.0  15 Jan 2024  Annual review; integrated third-party incident coordination
  v2.5  20 Jun 2023  Added automated detection SLAs
  v2.0  10 Jan 2023  Major revision; aligned with EBA Guidelines

Approved by: Board Risk Committee
Prepared by: Katrin Halvorsen, CISO
Date: 10 February 2025

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

incident_management_process_status — fs-incident-management-process

{
  "factId": "b1c2d3e4-f5a6-7890-abcd-200000000001",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000001",
  "evidenceClassId": "incident-management-process",
  "factType": "incident_management_process_status",
  "data": {
    "process_version": "3.1",
    "approval_date": "2025-02-10",
    "has_detection_mechanisms": true,
    "has_escalation_procedures": true,
    "has_communication_protocols": true,
    "response_team_defined": true,
    "last_simulation_date": "2024-11-18",
    "integrates_with_bcp": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-02-15T09:00:00Z",
  "supersededBy": null
}

incident_classification_taxonomy_status — fs-incident-classification-taxonomy

{
  "factId": "b1c2d3e4-f5a6-7890-abcd-200000000002",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000002",
  "evidenceClassId": "incident-classification-taxonomy",
  "factType": "incident_classification_taxonomy_status",
  "data": {
    "taxonomy_version": "2.0",
    "effective_date": "2025-01-20",
    "severity_levels_count": 4,
    "has_major_incident_thresholds": true,
    "covers_all_impact_dimensions": true,
    "impact_dimensions_covered": [
      "clients_affected",
      "duration",
      "geographical_spread",
      "data_losses",
      "service_criticality",
      "economic_impact"
    ],
    "aligned_with_esa_rts": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-02-15T09:00:00Z",
  "supersededBy": null
}

ICT Incident Classification Taxonomy PARTIAL

Structured JSON taxonomy defining incident classification criteria including severity levels, impact dimensions (clients affected, duration, geographical spread, data losses, criticality of services, economic impact) as required by DORA Article 18.

Formats: JSON
Evidence Class: incident-classification-taxonomy
Availability: PARTIAL
Update Frequency: annual
Typical Author: Incident Manager
Approval Chain: Incident Manager → CISO

Content Sections

Expected Fields

Common Quality Issues

Classification criteria not aligned with DORA Article 18 impact dimensions
Missing quantitative thresholds for major incident determination
No automated classification support
Taxonomy not updated to reflect ESA regulatory technical standards

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

JSON — Inline Preview

{
  "taxonomyVersion": "2.0",
  "effectiveDate": "2025-01-20",
  "institution": "Nordvik Bank AG",
  "approvedBy": "Katrin Halvorsen, CISO",
  "alignedWithESARTS": true,
  "severityLevels": [
    {
      "levelId": "SEV-01",
      "name": "Critical",
      "numericValue": 4,
      "description": "Incident causing severe disruption to critical business functions, affecting a large number of clients, or resulting in significant data loss. Requires immediate Board notification and regulatory reporting.",
      "responseTimeTarget": "15 minutes",
      "escalationRequired": true,
      "regulatoryReportingRequired": true
    },
    {
      "levelId": "SEV-02",
      "name": "High",
      "numericValue": 3,
      "description": "Incident causing material disruption to important business functions or affecting a significant number of clients. Requires CISO notification and potential regulatory reporting.",
      "responseTimeTarget": "30 minutes",
      "escalationRequired": true,
      "regulatoryReportingRequired": false
    },
    {
      "levelId": "SEV-03",
      "name": "Medium",
      "numericValue": 2,
      "description": "Incident causing limited disruption to standard business operations with contained impact. Managed within normal SOC operations.",
      "responseTimeTarget": "2 hours",
      "escalationRequired": false,
      "regulatoryReportingRequired": false
    },
    {
      "levelId": "SEV-04",
      "name": "Low",
      "numericValue": 1,
      "description": "Minor incident with negligible operational impact. Logged and resolved through standard service desk procedures.",
      "responseTimeTarget": "8 hours",
      "escalationRequired": false,
      "regulatoryReportingRequired": false
    }
  ],
  "impactDimensions": [
    {
      "dimensionId": "ID-01",
      "name": "Clients Affected",
      "description": "Number of financial service clients affected by the incident",
      "measurementUnit": "count",
      "thresholds": {
        "low": "< 100",
        "medium": "100 – 5,000",
        "high": "5,000 – 50,000",
        "critical": "> 50,000"
      }
    },
    {
      "dimensionId": "ID-02",
      "name": "Duration",
      "description": "Total duration of the incident from detection to full resolution",
      "measurementUnit": "hours",
      "thresholds": {
        "low": "< 2 hours",
        "medium": "2 – 12 hours",
        "high": "12 – 48 hours",
        "critical": "> 48 hours"
      }
    },
    {
      "dimensionId": "ID-03",
      "name": "Geographical Spread",
      "description": "Number of EU member states where clients are affected",
      "measurementUnit": "count of member states",
      "thresholds": {
        "low": "1 member state",
        "medium": "2 – 3 member states",
        "high": "4 – 10 member states",
        "critical": "> 10 member states"
      }
    },
    {
      "dimensionId": "ID-04",
      "name": "Data Losses",
      "description": "Volume and sensitivity of data compromised, lost, or corrupted",
      "measurementUnit": "records",
      "thresholds": {
        "low": "< 100 non-sensitive records",
        "medium": "100 – 10,000 records or any sensitive records",
        "high": "10,000 – 100,000 records including PII",
        "critical": "> 100,000 records or authentication credentials"
      }
    },
    {
      "dimensionId": "ID-05",
      "name": "Criticality of Services",
      "description": "Number and criticality level of business services affected",
      "measurementUnit": "service count and criticality",
      "thresholds": {
        "low": "Non-critical services only",
        "medium": "1 important service",
        "high": "1 critical service or multiple important services",
        "critical": "Multiple critical services or core banking"
      }
    },
    {
      "dimensionId": "ID-06",
      "name": "Economic Impact",
      "description": "Estimated direct and indirect financial impact of the incident",
      "measurementUnit": "EUR",
      "thresholds": {
        "low": "< EUR 100,000",
        "medium": "EUR 100,000 – 1,000,000",
        "high": "EUR 1,000,000 – 10,000,000",
        "critical": "> EUR 10,000,000"
      }
    }
  ],
  "majorIncidentThresholds": {
    "description": "An ICT-related incident is classified as major when it meets or exceeds the 'high' threshold in at least two impact dimensions, or the 'critical' threshold in any single dimension.",
    "rules": [
      {
        "ruleId": "MIT-01",
        "condition": "Any single impact dimension at 'critical' level",
        "result": "Major incident"
      },
      {
        "ruleId": "MIT-02",
        "condition": "Two or more impact dimensions at 'high' level",
        "result": "Major incident"
      },
      {
        "ruleId": "MIT-03",
        "condition": "Incident involves confirmed data breach of customer PII",
        "result": "Major incident (automatic)"
      },
      {
        "ruleId": "MIT-04",
        "condition": "Core banking or payment processing unavailable for > 2 hours",
        "result": "Major incident (automatic)"
      }
    ]
  },
  "classificationDecisionTree": {
    "step1": "Determine affected services and their criticality level",
    "step2": "Assess each of the six impact dimensions against thresholds",
    "step3": "Apply major incident threshold rules (MIT-01 through MIT-04)",
    "step4": "Assign overall severity based on highest dimension rating",
    "step5": "Document classification rationale in incident record",
    "step6": "Initiate regulatory notification if classified as major"
  }
}

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

incident_management_process_status — fs-incident-management-process

{
  "factId": "b1c2d3e4-f5a6-7890-abcd-200000000001",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000001",
  "evidenceClassId": "incident-management-process",
  "factType": "incident_management_process_status",
  "data": {
    "process_version": "3.1",
    "approval_date": "2025-02-10",
    "has_detection_mechanisms": true,
    "has_escalation_procedures": true,
    "has_communication_protocols": true,
    "response_team_defined": true,
    "last_simulation_date": "2024-11-18",
    "integrates_with_bcp": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-02-15T09:00:00Z",
  "supersededBy": null
}

incident_classification_taxonomy_status — fs-incident-classification-taxonomy

{
  "factId": "b1c2d3e4-f5a6-7890-abcd-200000000002",
  "evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000002",
  "evidenceClassId": "incident-classification-taxonomy",
  "factType": "incident_classification_taxonomy_status",
  "data": {
    "taxonomy_version": "2.0",
    "effective_date": "2025-01-20",
    "severity_levels_count": 4,
    "has_major_incident_thresholds": true,
    "covers_all_impact_dimensions": true,
    "impact_dimensions_covered": [
      "clients_affected",
      "duration",
      "geographical_spread",
      "data_losses",
      "service_criticality",
      "economic_impact"
    ],
    "aligned_with_esa_rts": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-02-15T09:00:00Z",
  "supersededBy": null
}

incident_management_process_status

Schema ID: fs-incident-management-process
Control: DORA-Art17-P1

Valid Ranges

approval_date: within last 18 months
last_simulation_date: within last 12 months

Related Schemas

JSON Schema

{
  "properties": {
    "approval_date": {
      "format": "date",
      "type": "string"
    },
    "has_communication_protocols": {
      "type": "boolean"
    },
    "has_detection_mechanisms": {
      "type": "boolean"
    },
    "has_escalation_procedures": {
      "type": "boolean"
    },
    "integrates_with_bcp": {
      "type": "boolean"
    },
    "last_simulation_date": {
      "format": "date",
      "type": "string"
    },
    "process_version": {
      "minLength": 1,
      "type": "string"
    },
    "response_team_defined": {
      "type": "boolean"
    }
  },
  "required": [
    "process_version",
    "approval_date",
    "has_detection_mechanisms",
    "has_escalation_procedures",
    "has_communication_protocols"
  ],
  "type": "object"
}

incident_classification_taxonomy_status

Schema ID: fs-incident-classification-taxonomy
Control: DORA-Art18-P1

Valid Ranges

effective_date: within last 18 months
severity_levels_count: typically 3-5 levels
impact_dimensions_covered: all 6 DORA dimensions for full compliance

Related Schemas

JSON Schema

{
  "properties": {
    "aligned_with_esa_rts": {
      "type": "boolean"
    },
    "covers_all_impact_dimensions": {
      "type": "boolean"
    },
    "effective_date": {
      "format": "date",
      "type": "string"
    },
    "has_major_incident_thresholds": {
      "type": "boolean"
    },
    "impact_dimensions_covered": {
      "items": {
        "enum": [
          "clients_affected",
          "duration",
          "geographical_spread",
          "data_losses",
          "service_criticality",
          "economic_impact"
        ],
        "type": "string"
      },
      "type": "array"
    },
    "severity_levels_count": {
      "minimum": 2,
      "type": "integer"
    },
    "taxonomy_version": {
      "minLength": 1,
      "type": "string"
    }
  },
  "required": [
    "taxonomy_version",
    "effective_date",
    "severity_levels_count",
    "has_major_incident_thresholds",
    "covers_all_impact_dimensions"
  ],
  "type": "object"
}

Evidence Profiles

ICT Incident Management Process Document COMMON

Content Sections

Expected Fields

Common Quality Issues

View Example

Expected Structured Facts

ICT Incident Classification Taxonomy PARTIAL

Content Sections

Expected Fields

Common Quality Issues

View Example

Expected Structured Facts

Fact Schemas

incident_management_process_status

Valid Ranges

Related Schemas

JSON Schema

incident_classification_taxonomy_status

Valid Ranges

Related Schemas

JSON Schema