DORA Art. 18 Free Tool
ICT Incident Classification Decision Tree
Interactive guide to classify ICT incidents per DORA Article 18 criteria. Determine reporting obligations and timelines.
ProgressStep 1 / 8
1
Step 1 of 8
Incident Detection
Has an ICT-related incident occurred?
DORA Article 3(8): An ICT-related incident is an unforeseen event in network and information systems that compromises the security of ICT services.
References & Legal Basis
DORA Art. 18 -- Classification
DORA Article 18 establishes ICT incident classification criteria: affected clients, duration, geographical spread, data loss, critical services impact, and economic loss.
EBA RTS/ITS -- Thresholds
EBA RTS/ITS specify classification thresholds and notification forms. Applicable from 2025.
DORA Art. 19 -- Reporting
DORA Article 19 establishes mandatory reporting timeline for major incidents: initial notification 4h, intermediate report 72h, final report 1 month.