Financial entities shall establish procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed.
CSV register of all ICT-related incidents including detection time, classification, impact, resolution, and follow-up status as required by DORA Article 21.
incident-logGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
incident_id,detection_timestamp,classification,severity,description,affected_systems,clients_affected,resolution_timestamp,duration_hours,root_cause,follow_up_status INC-2025-0042,2025-01-28T09:17:00Z,Service Availability,High,Core banking transaction processing failure — database connection pool exhaustion causing 35% transaction timeout rate,Core Banking (T24); Internet Banking; Mobile Banking,12340,2025-01-28T14:30:00Z,5.22,Connection pool exhaustion compounded by connection leak in batch processing module,Closed — all corrective actions completed INC-2025-0038,2025-01-15T14:22:00Z,Security,Medium,Phishing campaign targeting corporate banking clients — 12 emails identified and quarantined by email gateway,Email Gateway; Corporate Banking Portal,0,2025-01-15T16:45:00Z,2.38,External phishing campaign using spoofed domain,Closed — domain reported and blocked INC-2025-0035,2025-01-10T03:41:00Z,Infrastructure,Low,Scheduled failover test triggered unexpected alert — secondary DNS resolver briefly unreachable during maintenance window,DNS Infrastructure,0,2025-01-10T04:15:00Z,0.57,Maintenance script did not suppress monitoring alerts during planned failover,Closed — script updated INC-2025-0031,2025-01-06T11:08:00Z,Application,Medium,Wealth management portfolio reporting module returning stale data — cache invalidation failure after overnight batch update,Wealth Management Platform,250,2025-01-06T13:30:00Z,2.37,Cache invalidation event not triggered by batch job completion hook,Closed — batch job updated INC-2025-0028,2024-12-19T08:55:00Z,Security,High,Anomalous outbound data transfer detected — 650MB to external IP — investigation confirmed authorised bulk data export by vendor with insufficient access controls,Data Analytics Platform,0,2024-12-19T14:20:00Z,5.42,Vendor access controls did not enforce data volume limits,Closed — access controls tightened INC-2025-0024,2024-12-12T16:30:00Z,Infrastructure,Low,Branch network connectivity degradation — Swisscom WAN link flapping at Geneva branch,Branch Network (Geneva),45,2024-12-12T18:00:00Z,1.50,Swisscom router firmware bug — resolved by provider,Closed — provider applied patch INC-2025-0021,2024-12-05T09:12:00Z,Application,Medium,Mobile banking app crash on Android 14 devices after app update — null pointer exception in transaction history view,Mobile Banking Application,1820,2024-12-05T15:00:00Z,5.80,Null pointer exception in transaction history rendering for accounts with zero transactions,Closed — hotfix deployed INC-2025-0018,2024-11-28T22:15:00Z,Infrastructure,Low,SAN storage controller failover — automatic failover to secondary controller completed within 30 seconds — no service impact,SAN Storage Infrastructure,0,2024-11-28T22:45:00Z,0.50,Hardware fault on primary storage controller,Closed — controller replaced INC-2025-0015,2024-11-20T10:45:00Z,Security,Medium,Brute force attack on internet banking login — 4200 attempts from botnet — all blocked by rate limiting,Internet Banking Portal,0,2024-11-20T11:30:00Z,0.75,External brute force attack from distributed botnet,Closed — IP ranges blocked; rate limiting thresholds reviewed INC-2025-0012,2024-11-14T07:30:00Z,Application,High,SWIFT message processing delay — outbound payment messages queued for 45 minutes due to SWIFT Alliance Gateway certificate expiry,SWIFT Alliance Gateway; Payment Processing,890,2024-11-14T08:45:00Z,1.25,SWIFT Alliance Gateway TLS certificate expired — renewal process not triggered by monitoring,Closed — certificate monitoring added INC-2025-0009,2024-11-05T13:20:00Z,Infrastructure,Low,Development environment outage — Kubernetes cluster node failure — no production impact,Development Kubernetes Cluster,0,2024-11-05T14:00:00Z,0.67,Node hardware failure in development cluster,Closed — node replaced INC-2025-0006,2024-10-29T08:00:00Z,Application,Medium,Regulatory reporting module — quarterly COREP report generation failed due to data validation error,Regulatory Reporting Platform,0,2024-10-29T12:00:00Z,4.00,Data validation rule incorrectly rejecting valid entries after schema update,Closed — validation rule corrected INC-2025-0003,2024-10-22T15:45:00Z,Security,Low,Unauthorised USB device connected to workstation in trading floor — detected and blocked by endpoint DLP,End User Device (Trading Floor),0,2024-10-22T16:00:00Z,0.25,Employee attempted to use personal USB drive — blocked by policy,Closed — employee counselled INC-2025-0001,2024-10-15T06:00:00Z,Infrastructure,Medium,Oracle Database 19c performance degradation — query plan regression after statistics refresh,Core Banking Database,3200,2024-10-15T09:30:00Z,3.50,Oracle optimizer statistics refresh caused suboptimal query plans for high-volume transaction queries,Closed — statistics pinned; vendor consulted
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_log_status — fs-incident-log-status
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000008",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000008",
"evidenceClassId": "incident-log",
"factType": "incident_log_status",
"data": {
"reporting_period_end": "2025-01-31",
"total_incidents": 14,
"major_incidents": 1,
"incidents_with_root_cause": 14,
"incidents_resolved": 14,
"mean_time_to_detect_hours": 0.35,
"mean_time_to_resolve_hours": 2.43,
"follow_ups_completed": 14
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_root_cause_analysis — fs-incident-root-cause-analysis
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000007",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000007",
"evidenceClassId": "incident-root-cause-analysis",
"factType": "incident_root_cause_analysis",
"data": {
"incident_id": "INC-2025-0042",
"analysis_date": "2025-02-10",
"methodology_used": "combined",
"root_cause_identified": true,
"root_cause_category": "technical",
"corrective_actions_count": 5,
"corrective_actions_completed": 4,
"systemic_risk_identified": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
Detailed root cause analysis document for ICT-related incidents, using structured methodologies (5 Whys, fishbone diagram, fault tree analysis) to identify underlying causes and recommend corrective actions.
incident-root-cause-analysisGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
ICT INCIDENT ROOT CAUSE ANALYSIS REPORT
Nordvik Bank AG
Analysis Reference: RCA-INC-2025-0042
Incident ID: INC-2025-0042
Analysis Date: 10 February 2025
Classification: Confidential
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. INCIDENT SUMMARY
Incident Title: Core Banking Platform — Transaction Processing Failure
Incident Date: 28 January 2025
Duration: 5 hours 13 minutes (09:17 – 14:30 CET)
Severity: High (reclassified to Major during incident)
Impact: 12,340 clients affected; EUR 138,200 total financial impact
Data Loss: None
Brief Description:
Intermittent transaction processing failures on the Temenos T24 core banking
platform caused by database connection pool exhaustion. Approximately 35% of
payment transactions through digital channels failed with timeout errors during
the incident window.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2. ANALYSIS METHODOLOGY
Primary Method: 5 Whys Analysis
Supporting Method: Fault Tree Analysis
Data Sources:
— Application server logs (Temenos T24, 28 Jan 08:00–19:00 CET)
— Database connection pool metrics (Oracle, 28 Jan 00:00–23:59 CET)
— SIEM correlation events (Splunk, 28 Jan 09:00–15:00 CET)
— Application performance monitoring data (Dynatrace, 7-day window)
— Deployment records (December 2024 release notes)
— Capacity planning documentation (June 2024 review)
— Digital banking adoption metrics (Q3–Q4 2024)
Analysis Team:
— Marcus Weber, Incident Manager (Lead Analyst)
— Lars Eriksson, Head of IT Infrastructure
— Thomas Andersen, Head of Digital Banking
— DBA Lead, Database Administration
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
3. CONTRIBUTING FACTORS
Factor 1: Connection Leak in Batch Processing Module
─────────────────────────────────────────────────────────────────────────────
The batch payment reconciliation module, deployed in the December 2024 release
(v2024.12.1), contained a defect in its error handling path. When a batch
reconciliation query encountered a timeout or constraint violation, the module
failed to close the database connection before throwing the exception. Under
normal operation, this leak was masked because error-path execution was rare.
On the morning of 28 January, a batch reconciliation job processing 4,200
records encountered 23 constraint violations, leaking 23 connections.
Factor 2: Insufficient Connection Pool Capacity
─────────────────────────────────────────────────────────────────────────────
The T24 database connection pool was configured with a maximum of 500
connections, based on the capacity planning exercise conducted in June 2024.
That exercise used Q1 2024 peak transaction volumes (18,500 transactions/hour)
as the baseline. By January 2025, peak volumes had reached 22,400
transactions/hour — a 21% increase driven by the 15% growth in digital banking
adoption during Q4 2024.
Factor 3: Monitoring Threshold Too High
─────────────────────────────────────────────────────────────────────────────
The connection pool utilisation alert was configured to trigger at 95% (475 of
500 connections). At peak transaction rates, the pool could move from 95% to
100% in under 3 minutes, providing insufficient time for proactive intervention.
The alert triggered at 09:14 CET, only 3 minutes before the first transaction
failures.
Factor 4: Capacity Planning Cycle Gap
─────────────────────────────────────────────────────────────────────────────
The quarterly capacity planning cycle scheduled for Q4 2024 was deferred to
January 2025 due to the year-end change freeze. This meant the 15% growth in
digital banking adoption during Q4 2024 was not reflected in infrastructure
capacity adjustments before the incident.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
4. ROOT CAUSE IDENTIFICATION
Primary Root Cause:
Connection leak in the batch payment reconciliation module (v2024.12.1) that
failed to release database connections on the error handling path, combined
with a connection pool sized for Q1 2024 volumes that had been outgrown by
21% transaction growth.
Root Cause Category: Technical (software defect + infrastructure configuration)
Fault Tree Summary:
Transaction failures
├── Connection pool exhausted (500/500)
│ ├── Leaked connections from batch module (23 connections)
│ │ └── Missing connection.close() in catch block
│ ├── Peak load exceeding pool capacity
│ │ └── 21% volume growth since last capacity review
│ └── No automatic pool scaling configured
└── No failover to secondary node (manual process)
└── Automatic failover not implemented for T24
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
5. CORRECTIVE ACTIONS
ID Action Owner Deadline Status
─────────────────────────────────────────────────────────────────────────────
CA-01 Patch connection leak in batch module App Support 31 Jan Done
CA-02 Increase pool to 1500 (permanent) IT Infra 31 Jan Done
CA-03 Add error-path integration tests QA Lead 14 Feb Done
CA-04 Lower monitoring threshold to 75% SOC Manager 7 Feb Done
CA-05 Implement auto-scaling for pool IT Infra 28 Feb In progress
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6. PREVENTIVE RECOMMENDATIONS
ID Recommendation Owner Deadline
─────────────────────────────────────────────────────────────────────────────
PR-01 Move capacity planning to monthly cycle CIO 1 Mar 2025
PR-02 Deploy connection pool health dashboard IT Infra 28 Feb 2025
PR-03 Mandate connection cleanup verification Dev Lead 31 Mar 2025
in all code reviews for DB-accessing code
PR-04 Implement automated failover for T24 IT Infra 30 Jun 2025
PR-05 Add connection leak detection to CI/CD QA Lead 31 Mar 2025
pipeline (static analysis rule)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
7. IMPLEMENTATION PLAN
Phase 1 — Immediate (completed):
CA-01 through CA-04 completed within 14 days of incident
Phase 2 — Short-term (February 2025):
CA-05, PR-01, PR-02 targeted for completion by end of February
Phase 3 — Medium-term (Q1–Q2 2025):
PR-03, PR-04, PR-05 targeted for completion by end of Q2 2025
Tracking: All actions tracked in the ICT risk register under risk ID
ICT-R-2025-42. Monthly progress review by ICT Risk Committee.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Prepared by: Marcus Weber, Incident Manager
Reviewed by: Katrin Halvorsen, CISO
Approved by: Erik Lindqvist, CRO
Date: 10 February 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
incident_log_status — fs-incident-log-status
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000008",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000008",
"evidenceClassId": "incident-log",
"factType": "incident_log_status",
"data": {
"reporting_period_end": "2025-01-31",
"total_incidents": 14,
"major_incidents": 1,
"incidents_with_root_cause": 14,
"incidents_resolved": 14,
"mean_time_to_detect_hours": 0.35,
"mean_time_to_resolve_hours": 2.43,
"follow_ups_completed": 14
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
incident_root_cause_analysis — fs-incident-root-cause-analysis
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000007",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000007",
"evidenceClassId": "incident-root-cause-analysis",
"factType": "incident_root_cause_analysis",
"data": {
"incident_id": "INC-2025-0042",
"analysis_date": "2025-02-10",
"methodology_used": "combined",
"root_cause_identified": true,
"root_cause_category": "technical",
"corrective_actions_count": 5,
"corrective_actions_completed": 4,
"systemic_risk_identified": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
fs-incident-log-statusDORA-Art21-P1reporting_period_endincidents_with_root_cause{
"properties": {
"follow_ups_completed": {
"minimum": 0,
"type": "integer"
},
"incidents_resolved": {
"minimum": 0,
"type": "integer"
},
"incidents_with_root_cause": {
"minimum": 0,
"type": "integer"
},
"major_incidents": {
"minimum": 0,
"type": "integer"
},
"mean_time_to_detect_hours": {
"minimum": 0,
"type": "number"
},
"mean_time_to_resolve_hours": {
"minimum": 0,
"type": "number"
},
"reporting_period_end": {
"format": "date",
"type": "string"
},
"total_incidents": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"reporting_period_end",
"total_incidents",
"major_incidents",
"incidents_with_root_cause"
],
"type": "object"
}
fs-incident-root-cause-analysisDORA-Art21-P1analysis_datecorrective_actions_completed{
"properties": {
"analysis_date": {
"format": "date",
"type": "string"
},
"corrective_actions_completed": {
"minimum": 0,
"type": "integer"
},
"corrective_actions_count": {
"minimum": 0,
"type": "integer"
},
"incident_id": {
"minLength": 1,
"type": "string"
},
"methodology_used": {
"enum": [
"five_whys",
"fishbone",
"fault_tree",
"combined",
"other"
],
"type": "string"
},
"root_cause_category": {
"enum": [
"technical",
"process",
"human",
"external",
"vendor"
],
"type": "string"
},
"root_cause_identified": {
"type": "boolean"
},
"systemic_risk_identified": {
"type": "boolean"
}
},
"required": [
"incident_id",
"analysis_date",
"methodology_used",
"root_cause_identified",
"corrective_actions_count"
],
"type": "object"
}