Financial entities shall classify ICT-related incidents and shall determine their impact on the basis of criteria including the number of clients affected, the duration, the geographical spread, the data losses, the criticality of services affected and the economic impact.
Structured JSON taxonomy defining incident classification criteria including severity levels, impact dimensions (clients affected, duration, geographical spread, data losses, criticality of services, economic impact) as required by DORA Article 18.
incident-classification-taxonomyGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
{
"taxonomyVersion": "2.0",
"effectiveDate": "2025-01-20",
"institution": "Nordvik Bank AG",
"approvedBy": "Katrin Halvorsen, CISO",
"alignedWithESARTS": true,
"severityLevels": [
{
"levelId": "SEV-01",
"name": "Critical",
"numericValue": 4,
"description": "Incident causing severe disruption to critical business functions, affecting a large number of clients, or resulting in significant data loss. Requires immediate Board notification and regulatory reporting.",
"responseTimeTarget": "15 minutes",
"escalationRequired": true,
"regulatoryReportingRequired": true
},
{
"levelId": "SEV-02",
"name": "High",
"numericValue": 3,
"description": "Incident causing material disruption to important business functions or affecting a significant number of clients. Requires CISO notification and potential regulatory reporting.",
"responseTimeTarget": "30 minutes",
"escalationRequired": true,
"regulatoryReportingRequired": false
},
{
"levelId": "SEV-03",
"name": "Medium",
"numericValue": 2,
"description": "Incident causing limited disruption to standard business operations with contained impact. Managed within normal SOC operations.",
"responseTimeTarget": "2 hours",
"escalationRequired": false,
"regulatoryReportingRequired": false
},
{
"levelId": "SEV-04",
"name": "Low",
"numericValue": 1,
"description": "Minor incident with negligible operational impact. Logged and resolved through standard service desk procedures.",
"responseTimeTarget": "8 hours",
"escalationRequired": false,
"regulatoryReportingRequired": false
}
],
"impactDimensions": [
{
"dimensionId": "ID-01",
"name": "Clients Affected",
"description": "Number of financial service clients affected by the incident",
"measurementUnit": "count",
"thresholds": {
"low": "< 100",
"medium": "100 – 5,000",
"high": "5,000 – 50,000",
"critical": "> 50,000"
}
},
{
"dimensionId": "ID-02",
"name": "Duration",
"description": "Total duration of the incident from detection to full resolution",
"measurementUnit": "hours",
"thresholds": {
"low": "< 2 hours",
"medium": "2 – 12 hours",
"high": "12 – 48 hours",
"critical": "> 48 hours"
}
},
{
"dimensionId": "ID-03",
"name": "Geographical Spread",
"description": "Number of EU member states where clients are affected",
"measurementUnit": "count of member states",
"thresholds": {
"low": "1 member state",
"medium": "2 – 3 member states",
"high": "4 – 10 member states",
"critical": "> 10 member states"
}
},
{
"dimensionId": "ID-04",
"name": "Data Losses",
"description": "Volume and sensitivity of data compromised, lost, or corrupted",
"measurementUnit": "records",
"thresholds": {
"low": "< 100 non-sensitive records",
"medium": "100 – 10,000 records or any sensitive records",
"high": "10,000 – 100,000 records including PII",
"critical": "> 100,000 records or authentication credentials"
}
},
{
"dimensionId": "ID-05",
"name": "Criticality of Services",
"description": "Number and criticality level of business services affected",
"measurementUnit": "service count and criticality",
"thresholds": {
"low": "Non-critical services only",
"medium": "1 important service",
"high": "1 critical service or multiple important services",
"critical": "Multiple critical services or core banking"
}
},
{
"dimensionId": "ID-06",
"name": "Economic Impact",
"description": "Estimated direct and indirect financial impact of the incident",
"measurementUnit": "EUR",
"thresholds": {
"low": "< EUR 100,000",
"medium": "EUR 100,000 – 1,000,000",
"high": "EUR 1,000,000 – 10,000,000",
"critical": "> EUR 10,000,000"
}
}
],
"majorIncidentThresholds": {
"description": "An ICT-related incident is classified as major when it meets or exceeds the 'high' threshold in at least two impact dimensions, or the 'critical' threshold in any single dimension.",
"rules": [
{
"ruleId": "MIT-01",
"condition": "Any single impact dimension at 'critical' level",
"result": "Major incident"
},
{
"ruleId": "MIT-02",
"condition": "Two or more impact dimensions at 'high' level",
"result": "Major incident"
},
{
"ruleId": "MIT-03",
"condition": "Incident involves confirmed data breach of customer PII",
"result": "Major incident (automatic)"
},
{
"ruleId": "MIT-04",
"condition": "Core banking or payment processing unavailable for > 2 hours",
"result": "Major incident (automatic)"
}
]
},
"classificationDecisionTree": {
"step1": "Determine affected services and their criticality level",
"step2": "Assess each of the six impact dimensions against thresholds",
"step3": "Apply major incident threshold rules (MIT-01 through MIT-04)",
"step4": "Assign overall severity based on highest dimension rating",
"step5": "Document classification rationale in incident record",
"step6": "Initiate regulatory notification if classified as major"
}
}
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_classification_taxonomy_status — fs-incident-classification-taxonomy
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000002",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000002",
"evidenceClassId": "incident-classification-taxonomy",
"factType": "incident_classification_taxonomy_status",
"data": {
"taxonomy_version": "2.0",
"effective_date": "2025-01-20",
"severity_levels_count": 4,
"has_major_incident_thresholds": true,
"covers_all_impact_dimensions": true,
"impact_dimensions_covered": [
"clients_affected",
"duration",
"geographical_spread",
"data_losses",
"service_criticality",
"economic_impact"
],
"aligned_with_esa_rts": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_impact_assessment — fs-incident-impact-assessment
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000003",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000003",
"evidenceClassId": "incident-impact-assessment",
"factType": "incident_impact_assessment",
"data": {
"incident_id": "INC-2025-0042",
"assessment_date": "2025-01-28",
"severity_classification": "high",
"clients_affected_count": 12340,
"duration_hours": 5.22,
"geographical_regions_affected": 2,
"data_records_affected": 0,
"critical_services_impacted": 1,
"estimated_financial_impact_eur": 138200.00,
"is_major_incident": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
Template document for assessing the impact of ICT-related incidents across the six DORA-defined dimensions: clients affected, duration, geographical spread, data losses, criticality of services, and economic impact.
incident-impact-assessmentGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
ICT INCIDENT IMPACT ASSESSMENT
Nordvik Bank AG
Template Reference: TMPL-ICT-IIA-2025-001
Classification: Confidential
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
INCIDENT IDENTIFICATION
Incident ID: INC-2025-0042
Incident Title: Core Banking Platform — Intermittent Transaction Failures
Detection Timestamp: 2025-01-28T09:17:00Z
Classification: High (per TAX-ICT-INC-2025-001)
Assessment Date: 2025-01-28
Assessment Performed By: Marcus Weber, Incident Manager
Assessment Reviewed By: Katrin Halvorsen, CISO
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CLIENT IMPACT
Total Clients Affected: 12,340
Retail Banking Clients: 11,200 (unable to complete online transactions)
Corporate Banking Clients: 890 (delayed batch payment processing)
Wealth Management Clients: 250 (portfolio view unavailable)
Impact Description:
Clients experienced intermittent failures when attempting to execute payment
transactions through the internet banking and mobile banking channels. Approximately
35% of transaction attempts during the incident window resulted in timeout errors.
No transactions were incorrectly processed — all failed transactions were safely
rolled back by the core banking platform's transaction integrity mechanisms.
Client Communication:
Push notification sent to mobile banking users at 09:45 CET advising of
intermittent service disruption. Internet banking displayed a service advisory
banner. Customer service centre briefed at 09:30 CET with approved talking points.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DURATION ASSESSMENT
Incident Start: 2025-01-28T09:17:00Z (first automated alert)
Containment Achieved: 2025-01-28T10:45:00Z (traffic rerouted to secondary)
Full Resolution: 2025-01-28T14:30:00Z (root cause patched, primary restored)
Total Duration: 5 hours 13 minutes
Duration Breakdown:
Detection to Triage: 8 minutes
Triage to Containment: 1 hour 20 minutes
Containment to Fix: 3 hours 45 minutes
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
GEOGRAPHICAL SPREAD
Affected Regions: 2 EU member states
— Switzerland (primary operations): 10,800 clients
— Germany (cross-border banking): 1,540 clients
The incident did not affect operations in other jurisdictions. Branch operations
in Switzerland continued to function using the local transaction processing
fallback, though with reduced throughput.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DATA LOSS ASSESSMENT
Data Records Affected: 0
Data Breach: No
Data Corruption: No
Data Exfiltration: No
Assessment Notes:
The incident was a service availability issue caused by a database connection pool
exhaustion. No data was lost, corrupted, or exposed. Transaction integrity was
maintained throughout — all failed transactions were cleanly rolled back. Audit
logs confirm no unauthorised access occurred during the incident window.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SERVICE CRITICALITY IMPACT
Critical Services Impacted: 1
— Core Banking Transaction Processing (criticality: Critical)
Important Services Impacted: 2
— Internet Banking Portal (criticality: Important)
— Mobile Banking Application (criticality: Important)
Standard Services Impacted: 0
Service Degradation Details:
The core banking platform's Temenos T24 transaction processing module experienced
connection pool exhaustion under peak morning load, causing approximately 35% of
transactions to fail. The platform did not go fully offline — read operations
(balance enquiries, statement views) continued to function normally.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ECONOMIC IMPACT ESTIMATION
Direct Costs:
— Incident response team overtime: EUR 8,500
— Emergency vendor support (Temenos): EUR 15,000
— Customer service centre additional staffing: EUR 4,200
Total Direct Costs: EUR 27,700
Indirect Costs (estimated):
— Lost transaction fee revenue (5h window): EUR 42,000
— Customer goodwill compensation (fee waivers): EUR 18,500
— Reputational impact (estimated): EUR 50,000
Total Indirect Costs: EUR 110,500
Total Estimated Financial Impact: EUR 138,200
Methodology: Direct costs based on actual expenditure. Indirect costs estimated
using the Bank's incident cost model (REF: MOD-ICT-COST-2024-001) with
conservative assumptions for reputational impact.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
OVERALL SEVERITY DETERMINATION
Impact Dimension Rating Threshold Met
─────────────────────────────────────────────────────────────────────────────
Clients Affected High 12,340 (> 5,000)
Duration Medium 5h 13m (2–12 hours)
Geographical Spread Medium 2 member states
Data Losses Low 0 records
Service Criticality High 1 critical service
Economic Impact Medium EUR 138,200
Major Incident Determination: YES
Rationale: Two impact dimensions (Clients Affected, Service Criticality) at
'high' level, triggering rule MIT-02 of the classification taxonomy.
Regulatory Notification Required: YES
Initial notification deadline: 2025-01-28T13:17:00Z (4 hours from detection)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Prepared by: Marcus Weber, Incident Manager
Reviewed by: Katrin Halvorsen, CISO
Approved by: Erik Lindqvist, CRO
Date: 28 January 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_classification_taxonomy_status — fs-incident-classification-taxonomy
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000002",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000002",
"evidenceClassId": "incident-classification-taxonomy",
"factType": "incident_classification_taxonomy_status",
"data": {
"taxonomy_version": "2.0",
"effective_date": "2025-01-20",
"severity_levels_count": 4,
"has_major_incident_thresholds": true,
"covers_all_impact_dimensions": true,
"impact_dimensions_covered": [
"clients_affected",
"duration",
"geographical_spread",
"data_losses",
"service_criticality",
"economic_impact"
],
"aligned_with_esa_rts": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_impact_assessment — fs-incident-impact-assessment
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000003",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000003",
"evidenceClassId": "incident-impact-assessment",
"factType": "incident_impact_assessment",
"data": {
"incident_id": "INC-2025-0042",
"assessment_date": "2025-01-28",
"severity_classification": "high",
"clients_affected_count": 12340,
"duration_hours": 5.22,
"geographical_regions_affected": 2,
"data_records_affected": 0,
"critical_services_impacted": 1,
"estimated_financial_impact_eur": 138200.00,
"is_major_incident": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
fs-incident-classification-taxonomyDORA-Art18-P1effective_dateseverity_levels_countimpact_dimensions_covered{
"properties": {
"aligned_with_esa_rts": {
"type": "boolean"
},
"covers_all_impact_dimensions": {
"type": "boolean"
},
"effective_date": {
"format": "date",
"type": "string"
},
"has_major_incident_thresholds": {
"type": "boolean"
},
"impact_dimensions_covered": {
"items": {
"enum": [
"clients_affected",
"duration",
"geographical_spread",
"data_losses",
"service_criticality",
"economic_impact"
],
"type": "string"
},
"type": "array"
},
"severity_levels_count": {
"minimum": 2,
"type": "integer"
},
"taxonomy_version": {
"minLength": 1,
"type": "string"
}
},
"required": [
"taxonomy_version",
"effective_date",
"severity_levels_count",
"has_major_incident_thresholds",
"covers_all_impact_dimensions"
],
"type": "object"
}
fs-incident-impact-assessmentDORA-Art18-P1severity_classificationclients_affected_count{
"properties": {
"assessment_date": {
"format": "date",
"type": "string"
},
"clients_affected_count": {
"minimum": 0,
"type": "integer"
},
"critical_services_impacted": {
"minimum": 0,
"type": "integer"
},
"data_records_affected": {
"minimum": 0,
"type": "integer"
},
"duration_hours": {
"minimum": 0,
"type": "number"
},
"estimated_financial_impact_eur": {
"minimum": 0,
"type": "number"
},
"geographical_regions_affected": {
"minimum": 0,
"type": "integer"
},
"incident_id": {
"minLength": 1,
"type": "string"
},
"is_major_incident": {
"type": "boolean"
},
"severity_classification": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
},
"required": [
"incident_id",
"assessment_date",
"severity_classification",
"clients_affected_count",
"duration_hours"
],
"type": "object"
}