Financial entities shall ensure that ICT-related incident reports and post-incident reviews are used to identify vulnerabilities and improve the ICT risk management framework.
Plain text summary of post-incident review meetings, documenting key findings, process improvement recommendations, and action items for enhancing the ICT risk management framework as required by DORA Article 22.
post-incident-reviewGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
POST-INCIDENT REVIEW SUMMARY
Nordvik Bank AG
Review Date: 10 February 2025
Incident ID: INC-2025-0042
Incident Title: Core Banking Platform — Transaction Processing Failure
Review Location: Zurich HQ, Meeting Room 4A (hybrid — Teams bridge active)
Facilitator: Marcus Weber, Incident Manager
ATTENDEES
Name Role Attendance
─────────────────────────────────────────────────────────────────────
Marcus Weber Incident Manager In person
Katrin Halvorsen CISO In person
Lars Eriksson Head of IT Infrastructure In person
Thomas Andersen Head of Digital Banking Remote
Erik Lindqvist CRO In person
DBA Lead Database Administration In person
SOC Manager Security Operations In person
Petra Hoffman Head of Payment Services Remote
QA Lead Quality Assurance Remote
INCIDENT RECAP
On 28 January 2025, the core banking transaction processing platform experienced
intermittent failures due to database connection pool exhaustion on the Temenos
T24 system. The incident lasted 5 hours 13 minutes, affected 12,340 clients,
and resulted in approximately 35% of payment transactions failing during the
incident window. No data loss occurred. Total financial impact was EUR 138,200.
The root cause was a connection leak in the batch payment reconciliation module
(December 2024 release) combined with a connection pool sized for Q1 2024
volumes that had been outgrown by 21% transaction growth.
KEY FINDINGS
1. Detection was effective — automated alerts triggered within 3 minutes of the
first symptoms, and SOC triage was initiated within 8 minutes. The investment
in Splunk correlation rules and Dynatrace application monitoring paid off.
2. The escalation process worked as designed, but the initial severity
classification (High) should have been Major from the outset. The reclassification
to Major at 11:00 CET (1h 43m after detection) delayed the regulatory
notification preparation by approximately 30 minutes.
3. Containment took 1 hour 20 minutes — longer than the 1-hour target for High
severity incidents. The delay was caused by the need to identify the root cause
before applying the emergency pool increase, as the team initially suspected a
database performance issue rather than pool exhaustion.
4. The secondary processing node proved its value as a containment measure. The
active-passive configuration allowed traffic rerouting within 15 minutes of
the decision to failover.
5. Customer communication was timely (28 minutes after detection) but the initial
message was too vague. Corporate clients reported that the push notification
did not clearly indicate which services were affected.
PROCESS GAPS IDENTIFIED
Gap 1: Major incident classification criteria
The classification taxonomy requires assessment of all six DORA impact dimensions
before determining major incident status. In practice, this assessment takes
20-30 minutes, during which the incident is classified at a lower severity.
Recommendation: Add automatic major incident triggers for specific scenarios
(e.g., core banking transaction failure rate > 10%).
Gap 2: Connection pool monitoring
The 95% utilisation threshold provided only 3 minutes of warning before pool
exhaustion. This is insufficient for human intervention.
Recommendation: Lower threshold to 75% and add a trend-based predictive alert.
Gap 3: Capacity planning responsiveness
The quarterly capacity planning cycle was too slow to capture the Q4 2024
growth in digital banking adoption. The deferred Q4 review compounded the issue.
Recommendation: Move to monthly capacity reviews with automated growth tracking.
Gap 4: Release testing coverage
The December 2024 release containing the batch module was tested with happy-path
scenarios only. Error-path testing for database connection handling was not
included in the test plan.
Recommendation: Mandate connection cleanup verification in integration tests
for all database-accessing modules.
Gap 5: Customer communication templates
The incident communication templates are generic and do not provide service-
specific impact information. Corporate clients need more detailed information
about which services are affected and expected resolution times.
Recommendation: Create service-specific communication templates with impact
detail placeholders.
IMPROVEMENT RECOMMENDATIONS
ID Recommendation Priority Owner
─────────────────────────────────────────────────────────────────────────
IR-01 Add automatic major incident triggers High Incident Mgr
IR-02 Lower pool monitoring to 75% + trends High SOC Manager
IR-03 Monthly capacity planning cycle Medium CIO
IR-04 Mandate error-path DB connection tests High QA Lead
IR-05 Service-specific communication templates Medium Comms Manager
IR-06 Implement auto-scaling for DB pool High IT Infra
IR-07 Add connection leak static analysis Medium Dev Lead
ACTION ITEMS
ID Action Owner Target Date
─────────────────────────────────────────────────────────────────────────
AI-01 Update classification taxonomy with Marcus Weber 28 Feb 2025
automatic major incident triggers
AI-02 Revise monitoring thresholds SOC Manager Completed
AI-03 Present monthly capacity plan to ICTRC CIO 1 Mar 2025
AI-04 Update integration test standards QA Lead Completed
AI-05 Draft service-specific templates Comms Manager 31 Mar 2025
AI-06 Deploy connection pool auto-scaling IT Infra 28 Feb 2025
AI-07 Add static analysis rule to CI/CD Dev Lead 31 Mar 2025
FRAMEWORK UPDATE TRIGGERS
This review has identified the need to update the following framework documents:
— ICT Incident Classification Taxonomy (TAX-ICT-INC-2025-001): Add automatic
major incident triggers
— ICT Capacity Management Procedure: Move from quarterly to monthly cycle
— Software Development Standards: Add connection cleanup verification requirement
— Incident Communication Playbook: Add service-specific templates
POLICY CHANGE TRIGGERS
— ICT Risk Management Policy (POL-ICT-RM-2025-001): Update capacity planning
frequency requirement from quarterly to monthly
NEXT REVIEW
A follow-up review is scheduled for 10 April 2025 to verify implementation of
all action items and assess the effectiveness of the changes.
Minutes recorded by: Marcus Weber, Incident Manager
Reviewed by: Katrin Halvorsen, CISO
Date: 10 February 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
post_incident_review_status — fs-post-incident-review
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000009",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000009",
"evidenceClassId": "post-incident-review",
"factType": "post_incident_review_status",
"data": {
"review_date": "2025-02-10",
"incident_id": "INC-2025-0042",
"process_gaps_identified": 5,
"improvements_recommended": 7,
"improvements_implemented": 2,
"framework_updates_triggered": true,
"policy_changes_triggered": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
incident_trend_analysis — fs-incident-trend-analysis
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000010",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000010",
"evidenceClassId": "incident-trend-analysis",
"factType": "incident_trend_analysis",
"data": {
"reporting_period_start": "2024-10-01",
"reporting_period_end": "2025-01-31",
"total_incidents_in_period": 33,
"major_incidents_in_period": 1,
"trend_direction": "decreasing",
"recurring_root_causes_count": 2,
"mean_time_to_detect_trend": "improving",
"mean_time_to_resolve_trend": "improving"
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
CSV-based trend analysis of ICT-related incidents over time, identifying patterns, recurring issues, and areas requiring systemic improvement.
incident-trend-analysisGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
reporting_period,total_incidents,major_incidents,incidents_by_category_security,incidents_by_category_infrastructure,incidents_by_category_application,incidents_by_category_service_availability,mean_time_to_detect_hours,mean_time_to_resolve_hours,recurring_root_causes,trend_direction Q1 2024,18,0,5,6,5,2,0.52,3.10,"Configuration drift; patch management delays",stable Q2 2024,21,1,6,7,5,3,0.48,2.85,"Third-party service disruptions; configuration drift",increasing Q3 2024,16,0,4,5,4,3,0.41,2.60,"Software defects in releases; certificate management",decreasing Q4 2024,19,0,5,5,6,3,0.38,2.45,"Software defects in releases; capacity planning gaps",stable Q1 2025,14,1,3,4,4,3,0.35,2.43,"Connection management; capacity planning gaps",decreasing
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
post_incident_review_status — fs-post-incident-review
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000009",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000009",
"evidenceClassId": "post-incident-review",
"factType": "post_incident_review_status",
"data": {
"review_date": "2025-02-10",
"incident_id": "INC-2025-0042",
"process_gaps_identified": 5,
"improvements_recommended": 7,
"improvements_implemented": 2,
"framework_updates_triggered": true,
"policy_changes_triggered": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-28T09:00:00Z",
"supersededBy": null
}
incident_trend_analysis — fs-incident-trend-analysis
{
"factId": "b1c2d3e4-f5a6-7890-abcd-200000000010",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-200000000010",
"evidenceClassId": "incident-trend-analysis",
"factType": "incident_trend_analysis",
"data": {
"reporting_period_start": "2024-10-01",
"reporting_period_end": "2025-01-31",
"total_incidents_in_period": 33,
"major_incidents_in_period": 1,
"trend_direction": "decreasing",
"recurring_root_causes_count": 2,
"mean_time_to_detect_trend": "improving",
"mean_time_to_resolve_trend": "improving"
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-02-15T09:00:00Z",
"supersededBy": null
}
fs-post-incident-reviewDORA-Art22-P1review_dateimprovements_implemented{
"properties": {
"framework_updates_triggered": {
"type": "boolean"
},
"improvements_implemented": {
"minimum": 0,
"type": "integer"
},
"improvements_recommended": {
"minimum": 0,
"type": "integer"
},
"incident_id": {
"minLength": 1,
"type": "string"
},
"policy_changes_triggered": {
"type": "boolean"
},
"process_gaps_identified": {
"minimum": 0,
"type": "integer"
},
"review_date": {
"format": "date",
"type": "string"
}
},
"required": [
"review_date",
"incident_id",
"process_gaps_identified",
"improvements_recommended"
],
"type": "object"
}
fs-incident-trend-analysisDORA-Art22-P1reporting_period_endtrend_direction{
"properties": {
"major_incidents_in_period": {
"minimum": 0,
"type": "integer"
},
"mean_time_to_detect_trend": {
"enum": [
"improving",
"stable",
"degrading"
],
"type": "string"
},
"mean_time_to_resolve_trend": {
"enum": [
"improving",
"stable",
"degrading"
],
"type": "string"
},
"recurring_root_causes_count": {
"minimum": 0,
"type": "integer"
},
"reporting_period_end": {
"format": "date",
"type": "string"
},
"reporting_period_start": {
"format": "date",
"type": "string"
},
"total_incidents_in_period": {
"minimum": 0,
"type": "integer"
},
"trend_direction": {
"enum": [
"increasing",
"stable",
"decreasing"
],
"type": "string"
}
},
"required": [
"reporting_period_start",
"reporting_period_end",
"total_incidents_in_period",
"trend_direction"
],
"type": "object"
}