Financial entities shall report major ICT-related incidents to the relevant competent authority using initial notifications, intermediate reports and final reports within the prescribed timelines.
XML-structured template for the initial notification of major ICT-related incidents to competent authorities within the 4-hour timeline as required by DORA Article 19.
incident-initial-notificationGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
<?xml version="1.0" encoding="UTF-8"?>
<IncidentInitialNotification
notificationId="NTF-2025-0042-INIT"
incidentId="INC-2025-0042"
institution="Nordvik Bank AG"
competentAuthority="FINMA"
submissionStatus="Submitted">
<!-- ═══════════════════════════════════════════════════════════════════════
NOTIFICATION HEADER
Initial notification of a major ICT-related incident per DORA Art. 19
═══════════════════════════════════════════════════════════════════════ -->
<NotificationHeader>
<DetectionTimestamp>2025-01-28T09:17:00Z</DetectionTimestamp>
<ClassificationTimestamp>2025-01-28T09:35:00Z</ClassificationTimestamp>
<NotificationTimestamp>2025-01-28T12:48:00Z</NotificationTimestamp>
<HoursFromDetectionToNotification>3.52</HoursFromDetectionToNotification>
<Within4HourDeadline>true</Within4HourDeadline>
<SubmittedBy>Katrin Halvorsen, CISO</SubmittedBy>
<ContactPhone>+41 44 XXX XXXX</ContactPhone>
<ContactEmail>ciso@nordvik-bank.example</ContactEmail>
</NotificationHeader>
<!-- ═══════════════════════════════════════════════════════════════════════
INCIDENT SUMMARY
═══════════════════════════════════════════════════════════════════════ -->
<IncidentSummary>
<IncidentType>Service Availability — Transaction Processing Failure</IncidentType>
<Severity>High</Severity>
<MajorIncident>true</MajorIncident>
<Description>
Intermittent transaction processing failures on the core banking platform
(Temenos T24) caused by database connection pool exhaustion under peak
morning load. Approximately 35% of payment transactions through internet
banking and mobile banking channels failed with timeout errors during the
incident window. No data loss or unauthorised access occurred.
</Description>
<OngoingAtTimeOfNotification>true</OngoingAtTimeOfNotification>
</IncidentSummary>
<!-- ═══════════════════════════════════════════════════════════════════════
INITIAL IMPACT ASSESSMENT
═══════════════════════════════════════════════════════════════════════ -->
<InitialImpactAssessment>
<ClientsAffected>
<EstimatedCount>12340</EstimatedCount>
<Confidence>Medium — based on active session data at time of incident</Confidence>
</ClientsAffected>
<Duration>
<OngoingSince>2025-01-28T09:17:00Z</OngoingSince>
<EstimatedResolution>2025-01-28T15:00:00Z</EstimatedResolution>
</Duration>
<GeographicalSpread>
<MemberStatesAffected>2</MemberStatesAffected>
<Countries>Switzerland, Germany</Countries>
</GeographicalSpread>
<DataLosses>
<DataLossOccurred>false</DataLossOccurred>
<DataBreachOccurred>false</DataBreachOccurred>
</DataLosses>
<ServiceCriticality>
<CriticalServicesAffected>1</CriticalServicesAffected>
<ServiceNames>Core Banking Transaction Processing</ServiceNames>
</ServiceCriticality>
<EconomicImpact>
<PreliminaryEstimateEUR>100000</PreliminaryEstimateEUR>
<Confidence>Low — preliminary estimate pending full assessment</Confidence>
</EconomicImpact>
</InitialImpactAssessment>
<!-- ═══════════════════════════════════════════════════════════════════════
AFFECTED SERVICES
═══════════════════════════════════════════════════════════════════════ -->
<AffectedServices>
<Service serviceId="SVC-001" criticality="Critical">
<Name>Core Banking Transaction Processing</Name>
<Status>Degraded — 35% transaction failure rate</Status>
<ClientsRelying>All retail and corporate banking clients</ClientsRelying>
</Service>
<Service serviceId="SVC-002" criticality="Important">
<Name>Internet Banking Portal</Name>
<Status>Degraded — transaction functions affected, read-only functions operational</Status>
<ClientsRelying>8,200 active sessions at time of incident</ClientsRelying>
</Service>
<Service serviceId="SVC-003" criticality="Important">
<Name>Mobile Banking Application</Name>
<Status>Degraded — payment functions affected, balance and statement views operational</Status>
<ClientsRelying>4,140 active sessions at time of incident</ClientsRelying>
</Service>
</AffectedServices>
<!-- ═══════════════════════════════════════════════════════════════════════
PRELIMINARY ROOT CAUSE
═══════════════════════════════════════════════════════════════════════ -->
<PreliminaryRootCause>
<Category>Technical — Infrastructure Configuration</Category>
<Description>
Preliminary analysis indicates database connection pool exhaustion on the
Temenos T24 core banking platform. The connection pool maximum was set to
500 connections, which proved insufficient under the peak morning transaction
load following a 15% increase in digital banking adoption in Q4 2024. The
connection pool configuration had not been reviewed since the last capacity
planning exercise in June 2024.
</Description>
<ConfidenceLevel>Medium</ConfidenceLevel>
</PreliminaryRootCause>
<!-- ═══════════════════════════════════════════════════════════════════════
IMMEDIATE ACTIONS TAKEN
═══════════════════════════════════════════════════════════════════════ -->
<ImmediateActions>
<Action actionId="ACT-001" timestamp="2025-01-28T09:25:00Z">
<Description>SOC Analyst acknowledged alert and initiated triage</Description>
<Status>Completed</Status>
</Action>
<Action actionId="ACT-002" timestamp="2025-01-28T09:35:00Z">
<Description>Incident classified as High severity; IRT activated</Description>
<Status>Completed</Status>
</Action>
<Action actionId="ACT-003" timestamp="2025-01-28T10:00:00Z">
<Description>Emergency connection pool increase from 500 to 1000 applied</Description>
<Status>Completed</Status>
</Action>
<Action actionId="ACT-004" timestamp="2025-01-28T10:45:00Z">
<Description>Overflow traffic rerouted to secondary processing node</Description>
<Status>Completed</Status>
</Action>
<Action actionId="ACT-005" timestamp="2025-01-28T09:45:00Z">
<Description>Customer notification issued via mobile push and web banner</Description>
<Status>Completed</Status>
</Action>
</ImmediateActions>
</IncidentInitialNotification>
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_initial_notification — fs-incident-initial-notification
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000004",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000004",
"evidenceClassId": "incident-initial-notification",
"factType": "incident_initial_notification",
"data": {
"incident_id": "INC-2025-0042",
"detection_timestamp": "2025-01-28T09:17:00Z",
"notification_timestamp": "2025-01-28T12:48:00Z",
"incident_type": "Service Availability — Transaction Processing Failure",
"severity": "high",
"hours_to_notify": 3.52,
"within_4h_deadline": true,
"affected_services_count": 3,
"preliminary_impact_assessed": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_reporting_timeliness — fs-incident-reporting-timeliness
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000005",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000004",
"evidenceClassId": "incident-initial-notification",
"factType": "incident_reporting_timeliness",
"data": {
"incident_id": "INC-2025-0042",
"initial_notification_within_4h": true,
"initial_notification_hours": 3.52,
"intermediate_report_within_72h": true,
"intermediate_report_hours": 52.0,
"final_report_within_1m": true,
"final_report_days": 22,
"all_deadlines_met": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
Intermediate report submitted to competent authorities within 72 hours of a major ICT-related incident, providing updated impact assessment, root cause analysis progress, and recovery status.
incident-intermediate-reportGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
MAJOR ICT INCIDENT — INTERMEDIATE REPORT
Nordvik Bank AG
Report Reference: RPT-INC-2025-0042-INT
Incident ID: INC-2025-0042
Submission Date: 30 January 2025 (within 72-hour deadline)
Submitted To: Swiss Financial Market Supervisory Authority (FINMA)
Classification: Confidential — Regulatory
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
REPORT HEADER
Incident ID: INC-2025-0042
Incident Title: Core Banking Platform — Transaction Processing Failure
Initial Notification Ref: NTF-2025-0042-INIT (submitted 28 Jan 2025, 12:48 CET)
Intermediate Report Ref: RPT-INC-2025-0042-INT
Submission Timestamp: 2025-01-30T13:15:00Z
Hours Since Detection: 52.0 hours (within 72-hour deadline)
Report Prepared By: Marcus Weber, Incident Manager
Report Approved By: Katrin Halvorsen, CISO
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
UPDATED IMPACT ASSESSMENT
Dimension Initial Assessment Updated Assessment
─────────────────────────────────────────────────────────────────────────────
Clients Affected ~12,340 12,340 (confirmed)
Duration Ongoing (est. 6h) 5h 13m (resolved)
Geographical Spread 2 member states 2 member states (confirmed)
Data Losses None None (confirmed by audit)
Critical Services Impacted 1 1 (confirmed)
Economic Impact ~EUR 100,000 EUR 138,200 (refined)
Key Updates Since Initial Notification:
— The incident was fully resolved at 14:30 CET on 28 January 2025
— Total duration confirmed at 5 hours 13 minutes
— Client count confirmed through post-incident session log analysis
— No data loss or data breach confirmed through comprehensive audit log review
— Financial impact refined based on actual costs and revenue impact analysis
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ROOT CAUSE ANALYSIS PROGRESS
Root Cause Status: Confirmed
Root Cause Category: Technical — Infrastructure Configuration
Root Cause Description:
The incident was caused by database connection pool exhaustion on the Temenos T24
core banking platform. The connection pool was configured with a maximum of 500
concurrent connections, which was insufficient to handle the peak morning
transaction load.
Contributing factors identified:
1. Digital banking adoption increased 15% in Q4 2024, raising peak transaction
volumes beyond the capacity planned in June 2024
2. The connection pool configuration had not been reviewed as part of the
quarterly capacity planning cycle (last review: June 2024)
3. Connection pool monitoring alerts were configured with a threshold of 95%
utilisation, which provided insufficient lead time for proactive intervention
4. No automatic connection pool scaling was configured for the T24 platform
Root Cause Analysis Methodology: Combined approach using 5 Whys analysis and
timeline reconstruction. Full RCA report (REF: RCA-INC-2025-0042) to be
completed by 17 February 2025.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RECOVERY STATUS
Recovery Percentage: 100%
Service Restoration Timeline:
Timestamp Action Status
─────────────────────────────────────────────────────────────────────────────
28 Jan 09:17 CET Incident detected (automated alert) Complete
28 Jan 09:25 CET SOC triage initiated Complete
28 Jan 09:35 CET Classified as High; IRT activated Complete
28 Jan 10:00 CET Emergency pool increase (500→1000) Complete
28 Jan 10:45 CET Overflow traffic rerouted to secondary Complete
28 Jan 12:30 CET Permanent fix applied to primary node Complete
28 Jan 13:00 CET Primary node load testing completed Complete
28 Jan 14:00 CET Traffic gradually restored to primary Complete
28 Jan 14:30 CET Full service restoration confirmed Complete
28 Jan 15:00 CET Post-restoration monitoring period began Complete
28 Jan 18:00 CET Monitoring period ended; incident closed Complete
All services are operating normally. No residual issues have been observed
since service restoration.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CLIENT COMMUNICATION SUMMARY
Communication Type Timestamp Recipients
─────────────────────────────────────────────────────────────────────────────
Mobile push notification 28 Jan 09:45 CET All mobile banking users
Internet banking banner 28 Jan 09:45 CET All internet banking users
Service desk briefing 28 Jan 09:30 CET Customer service agents
Service restoration notice 28 Jan 15:00 CET All digital banking users
Apology communication 29 Jan 10:00 CET Affected corporate clients
Customer Complaints Received: 47 (all acknowledged within 4 hours)
Compensation Offered: Transaction fee waivers for affected corporate clients
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
REVISED TIMELINE
Milestone Target Date Status
─────────────────────────────────────────────────────────────────────────────
Full root cause analysis report 17 February 2025 In progress
Permanent capacity increase 7 February 2025 Scheduled
Connection pool auto-scaling 28 February 2025 Planned
Monitoring threshold revision 7 February 2025 Scheduled
Post-incident review meeting 10 February 2025 Scheduled
Final report to FINMA 28 February 2025 Planned
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Prepared by: Marcus Weber, Incident Manager
Reviewed by: Katrin Halvorsen, CISO
Approved by: Erik Lindqvist, CRO
Date: 30 January 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_initial_notification — fs-incident-initial-notification
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000004",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000004",
"evidenceClassId": "incident-initial-notification",
"factType": "incident_initial_notification",
"data": {
"incident_id": "INC-2025-0042",
"detection_timestamp": "2025-01-28T09:17:00Z",
"notification_timestamp": "2025-01-28T12:48:00Z",
"incident_type": "Service Availability — Transaction Processing Failure",
"severity": "high",
"hours_to_notify": 3.52,
"within_4h_deadline": true,
"affected_services_count": 3,
"preliminary_impact_assessed": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_reporting_timeliness — fs-incident-reporting-timeliness
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000005",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000004",
"evidenceClassId": "incident-initial-notification",
"factType": "incident_reporting_timeliness",
"data": {
"incident_id": "INC-2025-0042",
"initial_notification_within_4h": true,
"initial_notification_hours": 3.52,
"intermediate_report_within_72h": true,
"intermediate_report_hours": 52.0,
"final_report_within_1m": true,
"final_report_days": 22,
"all_deadlines_met": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
Final report submitted to competent authorities within one month of a major ICT-related incident, containing complete root cause analysis, total impact assessment, and preventive measures as required by DORA Articles 19-20.
incident-final-reportGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
MAJOR ICT INCIDENT — FINAL REPORT
Nordvik Bank AG
Report Reference: RPT-INC-2025-0042-FINAL
Incident ID: INC-2025-0042
Submission Date: 19 February 2025 (within one-month deadline)
Submitted To: Swiss Financial Market Supervisory Authority (FINMA)
Classification: Confidential — Regulatory
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
EXECUTIVE SUMMARY
On 28 January 2025, Nordvik Bank AG experienced a major ICT-related incident
affecting the core banking transaction processing platform. The incident was caused
by database connection pool exhaustion on the Temenos T24 system under peak morning
transaction load, resulting in approximately 35% of payment transactions failing
over a 5-hour 13-minute window.
The incident affected 12,340 clients across Switzerland and Germany, with a total
estimated financial impact of EUR 138,200. No data loss, data breach, or
unauthorised access occurred. All regulatory reporting deadlines were met: initial
notification within 3.5 hours, intermediate report within 52 hours, and this final
report within 22 days.
Root cause analysis identified four contributing factors, and five preventive
measures have been defined with implementation timelines extending to Q2 2025.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
INCIDENT TIMELINE
Date/Time (CET) Event
─────────────────────────────────────────────────────────────────────────────
28 Jan 09:17 First automated alert — Splunk correlation rule
triggered on elevated T24 transaction timeout rate
28 Jan 09:20 Second alert — Dynatrace application monitoring
detected response time degradation on T24 API
28 Jan 09:25 SOC Analyst acknowledged alerts; triage initiated
28 Jan 09:30 Customer service centre briefed with talking points
28 Jan 09:35 Incident classified as High severity; IRT activated
28 Jan 09:45 Customer notifications issued (push + web banner)
28 Jan 10:00 Emergency connection pool increase (500 → 1000)
applied; partial improvement observed
28 Jan 10:15 Root cause identified as connection pool exhaustion
compounded by connection leak in batch processing module
28 Jan 10:45 Overflow traffic rerouted to secondary processing node;
containment achieved — failure rate dropped to < 2%
28 Jan 11:00 Incident reclassified as Major per taxonomy rule MIT-02
28 Jan 12:30 Permanent fix applied: connection leak patched, pool
size set to 1500 on primary node
28 Jan 12:48 Initial notification submitted to FINMA (3h 31m)
28 Jan 13:00 Load testing of primary node completed successfully
28 Jan 14:00 Traffic gradually restored to primary node
28 Jan 14:30 Full service restoration confirmed
28 Jan 18:00 Post-restoration monitoring period ended; no issues
30 Jan 13:15 Intermediate report submitted to FINMA (52h)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
COMPLETE IMPACT ASSESSMENT
Impact Dimension Final Assessment
─────────────────────────────────────────────────────────────────────────────
Clients Affected 12,340 (11,200 retail, 890 corporate, 250 wealth)
Total Duration 5 hours 13 minutes
Geographical Spread 2 EU member states (Switzerland, Germany)
Data Losses 0 records (confirmed by forensic audit)
Critical Services Impacted 1 (Core Banking Transaction Processing)
Total Financial Impact EUR 138,200
Financial Impact Breakdown:
Direct costs (response, vendor support, staffing): EUR 27,700
Lost transaction fee revenue: EUR 42,000
Customer goodwill compensation: EUR 18,500
Estimated reputational impact: EUR 50,000
Transaction Impact:
Total transactions attempted during incident window: 28,450
Transactions failed (timeout): 9,958 (35%)
Transactions successfully retried after resolution: 9,958 (100%)
Transactions incorrectly processed: 0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ROOT CAUSE ANALYSIS
Analysis Reference: RCA-INC-2025-0042
Analysis Date: 10 February 2025
Methodology: Combined 5 Whys and Fault Tree Analysis
Lead Analyst: Marcus Weber, Incident Manager
Root Cause:
Database connection pool exhaustion on the Temenos T24 core banking platform,
compounded by a connection leak in the batch payment processing module.
5 Whys Analysis:
Why 1: Why did transactions fail?
→ The T24 application server could not obtain database connections to process
incoming transaction requests.
Why 2: Why were database connections unavailable?
→ The connection pool (max 500) was fully consumed, with no connections being
returned to the pool in a timely manner.
Why 3: Why were connections not being returned?
→ The batch payment processing module (deployed in the December 2024 release)
contained a connection leak — connections opened for batch reconciliation
were not properly closed in the error handling path.
Why 4: Why was the connection leak not detected before production?
→ The batch module's integration tests did not include error-path scenarios
that would trigger the leak. The connection pool monitoring threshold (95%)
was too high to provide early warning.
Why 5: Why was the connection pool sized at 500?
→ The pool size was set during the June 2024 capacity planning exercise based
on Q1 2024 peak volumes. The 15% increase in digital banking adoption in
Q4 2024 was not reflected in a capacity review.
Contributing Factors:
1. Connection leak in batch processing module (December 2024 release)
2. Insufficient connection pool capacity for current transaction volumes
3. Monitoring threshold too high (95%) for timely proactive intervention
4. Capacity planning cycle did not account for Q4 2024 growth
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RECOVERY ACTIONS
Action Date Completed Performed By
─────────────────────────────────────────────────────────────────────────────
Emergency connection pool increase 28 Jan 2025 IT Infrastructure
Traffic rerouted to secondary node 28 Jan 2025 IT Infrastructure
Connection leak hotfix deployed 28 Jan 2025 Application Support
Primary node restored and verified 28 Jan 2025 IT Infrastructure
Post-restoration monitoring (3h) 28 Jan 2025 SOC
Batch module regression test suite run 29 Jan 2025 QA Team
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PREVENTIVE MEASURES
ID Measure Owner Target Date
─────────────────────────────────────────────────────────────────────────────
PM-01 Implement automatic connection pool IT Infra 28 Feb 2025
scaling with dynamic upper bound
PM-02 Revise monitoring thresholds: alert at SOC Manager 7 Feb 2025
75% pool utilisation (was 95%)
PM-03 Add connection leak detection tests to QA Lead 14 Feb 2025
all database-accessing modules
PM-04 Move capacity planning to monthly CIO 1 Mar 2025
review cycle (was quarterly)
PM-05 Deploy connection pool health dashboard IT Infra 28 Feb 2025
with trend analysis and forecasting
Implementation Status (as of report date):
PM-01: In progress (vendor engagement completed)
PM-02: Completed (7 February 2025)
PM-03: Completed (12 February 2025)
PM-04: Approved; first monthly review scheduled 1 March 2025
PM-05: In progress (dashboard design completed)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
LESSONS LEARNED
1. Connection pool monitoring thresholds must provide sufficient lead time for
proactive intervention — 95% is too late for a pool that can exhaust in
minutes under peak load.
2. Capacity planning must be responsive to business growth metrics. A quarterly
cycle is insufficient when digital adoption is growing at 15% per quarter.
3. Integration testing for database-accessing modules must include error-path
scenarios that verify connection cleanup.
4. The secondary processing node proved effective as a containment measure,
validating the investment in active-passive redundancy for the T24 platform.
5. Regulatory notification process worked as designed — all deadlines met with
margin. The pre-prepared notification templates reduced preparation time.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
REGULATORY COMPLIANCE ASSESSMENT
Reporting Obligation Deadline Actual Status
─────────────────────────────────────────────────────────────────────────────
Initial notification (4h) 28 Jan 13:17 CET 28 Jan 12:48 CET Met
Intermediate report (72h) 31 Jan 09:17 CET 30 Jan 13:15 CET Met
Final report (1 month) 28 Feb 2025 19 Feb 2025 Met
The Bank's incident management process operated in compliance with DORA
Articles 17–20 throughout this incident. All regulatory reporting deadlines
were met, and the competent authority was kept informed at each stage.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Prepared by: Marcus Weber, Incident Manager
Root Cause Analysis by: Marcus Weber, Incident Manager
Reviewed by: Katrin Halvorsen, CISO
Approved by: Erik Lindqvist, CRO
Board Risk Committee notified: 19 February 2025
Date: 19 February 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_initial_notification — fs-incident-initial-notification
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000004",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000004",
"evidenceClassId": "incident-initial-notification",
"factType": "incident_initial_notification",
"data": {
"incident_id": "INC-2025-0042",
"detection_timestamp": "2025-01-28T09:17:00Z",
"notification_timestamp": "2025-01-28T12:48:00Z",
"incident_type": "Service Availability — Transaction Processing Failure",
"severity": "high",
"hours_to_notify": 3.52,
"within_4h_deadline": true,
"affected_services_count": 3,
"preliminary_impact_assessed": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_reporting_timeliness — fs-incident-reporting-timeliness
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000005",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000004",
"evidenceClassId": "incident-initial-notification",
"factType": "incident_reporting_timeliness",
"data": {
"incident_id": "INC-2025-0042",
"initial_notification_within_4h": true,
"initial_notification_hours": 3.52,
"intermediate_report_within_72h": true,
"intermediate_report_hours": 52.0,
"final_report_within_1m": true,
"final_report_days": 22,
"all_deadlines_met": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
fs-incident-initial-notificationDORA-Art19-P1hours_to_notifynotification_timestamp{
"properties": {
"affected_services_count": {
"minimum": 0,
"type": "integer"
},
"detection_timestamp": {
"format": "date-time",
"type": "string"
},
"hours_to_notify": {
"minimum": 0,
"type": "number"
},
"incident_id": {
"minLength": 1,
"type": "string"
},
"incident_type": {
"minLength": 1,
"type": "string"
},
"notification_timestamp": {
"format": "date-time",
"type": "string"
},
"preliminary_impact_assessed": {
"type": "boolean"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"within_4h_deadline": {
"type": "boolean"
}
},
"required": [
"incident_id",
"detection_timestamp",
"notification_timestamp",
"incident_type",
"severity"
],
"type": "object"
}
fs-incident-reporting-timelinessDORA-Art19-P1initial_notification_hoursintermediate_report_hoursfinal_report_days{
"properties": {
"all_deadlines_met": {
"type": "boolean"
},
"final_report_days": {
"minimum": 0,
"type": "integer"
},
"final_report_within_1m": {
"type": "boolean"
},
"incident_id": {
"minLength": 1,
"type": "string"
},
"initial_notification_hours": {
"minimum": 0,
"type": "number"
},
"initial_notification_within_4h": {
"type": "boolean"
},
"intermediate_report_hours": {
"minimum": 0,
"type": "number"
},
"intermediate_report_within_72h": {
"type": "boolean"
}
},
"required": [
"incident_id",
"initial_notification_within_4h",
"intermediate_report_within_72h",
"final_report_within_1m"
],
"type": "object"
}