Major ICT-related incident reporting
Under DORA, financial entities must classify ICT-related incidents with common criteria and report major ones to their competent authority in three steps: an initial notification, an intermediate report and a final report with root causes. Reporting of significant cyber threats is voluntary.