DORA Incident Reporting – Operational Instructions

DORA Incident Reporting – Operational Instructions

The Operational Instructions are joint guidance from the European Supervisory Authorities (ESMA, EBA and EIOPA) to national competent authorities on applying DORA's major ICT-related incident reporting framework under Articles 17 to 19 DORA. They clarify how the Implementing Technical Standards on reporting templates and procedures (ITS 2025/302), the Regulatory Technical Standards on content, timelines and notification (RTS 2025/301), and the Regulatory Technical Standards on incident classification and materiality thresholds (RTS 2024/1772) should be applied in practice. The document sets out fourteen operational points, including mandatory English-language templates, expressing monetary fields in thousands of units, conventions for free-text fields, final-report submission timelines, consistent unique incident identifiers, documentation of the "critical services affected" criterion, geographic-spread recording, standardised third-party provider information, accuracy indicators for duration and downtime, common threat-classification terminology, resolution-authority information, and economic-impact materiality thresholds. The instructions apply to DORA in-scope financial entities reporting major ICT-related incidents to their national competent authority, which relays standardised reports to the ESAs. They are framed as staff-level recommendations applied on a best-efforts basis, not formal legal interpretations, and subject to periodic updates.