DORA-Art19-P1

Incident Initial Notification Template PARTIAL

XML-structured template for the initial notification of major ICT-related incidents to competent authorities within the 4-hour timeline as required by DORA Article 19.

Formats

XML

Evidence Class

incident-initial-notification

Availability

PARTIAL

Update Frequency

event-driven

Typical Author

Incident Response Team Lead

Approval Chain

Incident Response Team Lead → CISO

Content Sections

• Notification Header
• Incident Summary
• Initial Impact Assessment
• Affected Services
• Preliminary Root Cause
• Immediate Actions Taken

Expected Fields

• notification_id
• incident_id
• detection_timestamp
• notification_timestamp
• incident_type
• severity
• affected_services
• preliminary_impact
• immediate_actions

Common Quality Issues

• Notification submitted beyond 4-hour deadline
• Incomplete preliminary impact assessment
• Missing affected services enumeration
• Template not aligned with ESA reporting format requirements

Incident Intermediate Report PARTIAL

Intermediate report submitted to competent authorities within 72 hours of a major ICT-related incident, providing updated impact assessment, root cause analysis progress, and recovery status.

Formats

PDF DOCX

Evidence Class

incident-intermediate-report

Availability

PARTIAL

Update Frequency

event-driven

Typical Author

Incident Manager

Approval Chain

Incident Manager → CISO → CRO

Content Sections

• Report Header
• Updated Impact Assessment
• Root Cause Analysis Progress
• Recovery Status
• Client Communication Summary
• Revised Timeline

Expected Fields

• report_id
• incident_id
• submission_timestamp
• updated_clients_affected
• updated_duration
• root_cause_progress
• recovery_percentage
• estimated_resolution_date

Common Quality Issues

• Report submitted beyond 72-hour deadline
• Root cause analysis still at preliminary stage
• Recovery status overly optimistic compared to actual progress
• Missing quantified economic impact update

Incident Final Report COMMON

Final report submitted to competent authorities within one month of a major ICT-related incident, containing complete root cause analysis, total impact assessment, and preventive measures as required by DORA Articles 19-20.

Formats

PDF

Evidence Class

incident-final-report

Availability

COMMON

Update Frequency

event-driven

Typical Author

CISO

Approval Chain

CISO → CRO → Board Risk Committee

Content Sections

• Executive Summary
• Incident Timeline
• Complete Impact Assessment
• Root Cause Analysis
• Recovery Actions
• Preventive Measures
• Lessons Learned
• Regulatory Compliance Assessment

Expected Fields

• report_id
• incident_id
• submission_date
• total_duration_hours
• total_clients_affected
• total_financial_impact
• root_cause
• preventive_measures
• implementation_timeline

Common Quality Issues

• Report submitted beyond one-month deadline
• Root cause analysis superficial — stops at proximate cause
• Preventive measures generic without specific implementation timelines
• Missing quantified total economic impact

incident_initial_notification

Schema ID

fs-incident-initial-notification

Control

DORA-Art19-P1

Valid Ranges

hours_to_notify

must be <= 4 for compliance with initial notification deadline

notification_timestamp

within 4 hours of detection_timestamp

Related Schemas

• fs-incident-reporting-timeliness
• fs-incident-impact-assessment

JSON Schema

{
  "properties": {
    "affected_services_count": {
      "minimum": 0,
      "type": "integer"
    },
    "detection_timestamp": {
      "format": "date-time",
      "type": "string"
    },
    "hours_to_notify": {
      "minimum": 0,
      "type": "number"
    },
    "incident_id": {
      "minLength": 1,
      "type": "string"
    },
    "incident_type": {
      "minLength": 1,
      "type": "string"
    },
    "notification_timestamp": {
      "format": "date-time",
      "type": "string"
    },
    "preliminary_impact_assessed": {
      "type": "boolean"
    },
    "severity": {
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ],
      "type": "string"
    },
    "within_4h_deadline": {
      "type": "boolean"
    }
  },
  "required": [
    "incident_id",
    "detection_timestamp",
    "notification_timestamp",
    "incident_type",
    "severity"
  ],
  "type": "object"
}

incident_reporting_timeliness

Schema ID

fs-incident-reporting-timeliness

Control

DORA-Art19-P1

Valid Ranges

initial_notification_hours

<= 4 hours for compliance

intermediate_report_hours

<= 72 hours for compliance

final_report_days

<= 30 days for compliance

Related Schemas

• fs-incident-initial-notification
• fs-incident-final-report

JSON Schema

{
  "properties": {
    "all_deadlines_met": {
      "type": "boolean"
    },
    "final_report_days": {
      "minimum": 0,
      "type": "integer"
    },
    "final_report_within_1m": {
      "type": "boolean"
    },
    "incident_id": {
      "minLength": 1,
      "type": "string"
    },
    "initial_notification_hours": {
      "minimum": 0,
      "type": "number"
    },
    "initial_notification_within_4h": {
      "type": "boolean"
    },
    "intermediate_report_hours": {
      "minimum": 0,
      "type": "number"
    },
    "intermediate_report_within_72h": {
      "type": "boolean"
    }
  },
  "required": [
    "incident_id",
    "initial_notification_within_4h",
    "intermediate_report_within_72h",
    "final_report_within_1m"
  ],
  "type": "object"
}