DORA in practice: the three report clocks, the major-incident gate, and the evidence pack

DORA has been enforceable since 17 January 2025. Under Article 5 of Commission Delegated Regulation (EU) 2025/301 each of the three reports on a major ICT-related incident runs from a different event, and only one of them runs from detection. This memo rebuilds the three deadlines against that article, ships a function that computes them, separates the Article 35 penalty on critical ICT third-party providers from the Article 50 regime that applies to financial entities, and lists the evidence the regulation requires you to hold. Every article number, time limit and threshold below is cited to the instrument that carries it; where a statement rests on something else, the source is named in the sentence.

The two paragraphs that carry the audit weight

Article 6 of Regulation (EU) 2022/2554 sets the written ICT risk-management framework. Two of its paragraphs impose distinct obligations on the same population. Article 6(4) requires financial entities other than microenterprises to assign responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence, so that conflicts of interest are avoided, with segregation following the three lines of defence model. Article 6(6) is a separate obligation on the same population: the framework of entities other than microenterprises must be subject to internal audit by auditors with sufficient knowledge, skills and expertise in ICT risk, and appropriate independence. The internal-audit wording sits only in 6(6), and the microenterprise carve-out sits in both.

The reporting clock, rebuilt against the delegated regulation

Article 19 of DORA creates the obligation. Article 5 of Commission Delegated Regulation (EU) 2025/301 sets the time limits, and each report runs from a different event.

Each downstream report is measured from a submission, so it inherits any delay in the leg above it. Article 5 also carries a narrow weekend and bank-holiday extension that does not reach every entity; read the provision before a procedure relies on it.

Computing the three deadlines, with expected output

This function takes the awareness timestamp and the classification timestamp and returns the three deadlines. It was written for PowerShell 7 and deliberately omits the weekend extension.

# DORA major-incident reporting deadlines.
# Time limits per Commission Delegated Regulation (EU) 2025/301, Article 5.
# Pass ISO 8601 timestamps with the Z suffix.

function Get-DoraReportingDeadlines {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)][datetime] $AwareUtc,
        [Parameter(Mandatory)][datetime] $ClassifiedMajorUtc,
        [datetime] $InitialSubmittedUtc,
        [datetime] $LatestIntermediateSubmittedUtc
    )

    $aware    = $AwareUtc.ToUniversalTime()
    $classed  = $ClassifiedMajorUtc.ToUniversalTime()
    $backstop = $aware.AddHours(24)
    $fromCls  = $classed.AddHours(4)

    # Four hours from classification, capped by the 24-hour awareness backstop.
    # A classification made after the backstop has passed keeps only the 4-hour leg.
    if ($classed -gt $backstop)     { $initialDue = $fromCls }
    elseif ($fromCls -lt $backstop) { $initialDue = $fromCls }
    else                            { $initialDue = $backstop }

    $initialAt = if ($PSBoundParameters.ContainsKey('InitialSubmittedUtc')) {
        $InitialSubmittedUtc.ToUniversalTime()
    } else { $initialDue }

    $intermediateDue = $initialAt.AddHours(72)

    $finalBase = if ($PSBoundParameters.ContainsKey('LatestIntermediateSubmittedUtc')) {
        $LatestIntermediateSubmittedUtc.ToUniversalTime()
    } else { $intermediateDue }

    $iso = "yyyy-MM-ddTHH:mm:ss'Z'"
    [pscustomobject][ordered]@{
        AwarenessBackstop = $backstop.ToString($iso)
        InitialDue        = $initialDue.ToString($iso)
        IntermediateDue   = $intermediateDue.ToString($iso)
        FinalDue          = $finalBase.AddMonths(1).ToString($iso)
    }
}

Get-DoraReportingDeadlines -AwareUtc '2026-03-02T06:10:00Z' -ClassifiedMajorUtc '2026-03-03T04:00:00Z' -InitialSubmittedUtc '2026-03-03T05:30:00Z' -LatestIntermediateSubmittedUtc '2026-03-06T05:00:00Z' | Format-List

Expected output, for a team aware at 06:10 UTC that classified almost 22 hours later:

AwarenessBackstop : 2026-03-03T06:10:00Z
InitialDue        : 2026-03-03T06:10:00Z
IntermediateDue   : 2026-03-06T05:30:00Z
FinalDue          : 2026-04-06T05:00:00Z

The four-hour leg alone would have permitted 08:00. The backstop pulls the notification forward by one hour and fifty minutes. Run the function against the last three incidents in the register and compare its answer with what the procedure told the team at the time.

When an incident becomes major

Classification criteria and materiality thresholds are harmonised across the Union by Commission Delegated Regulation (EU) 2024/1772, so an entity operating in several Member States needs one threshold set. Article 8 makes the test conditional. An incident is major where it has affected critical services and where either the data-loss threshold at Article 9(5), point (b), is met, or two or more of the other Article 9 materiality thresholds are met. Impact on critical services is a gate: it has to be met before any threshold count begins.

Article 9 sets the client and transaction limbs at more than 10 percent of the clients using the affected service, more than 100,000 clients, more than 30 percent of the financial counterparts carrying out activities related to the affected service, and more than 10 percent of the daily average number or value of transactions. The other limbs are reputational impact, duration beyond 24 hours or downtime beyond two hours for services supporting critical or important functions, impact in two or more Member States, data losses, and costs and losses that have exceeded or are likely to exceed EUR 100,000. That forward-looking limb changes triage behaviour, because it bites while the incident is still open. Article 8(2) then treats recurring incidents with the same apparent root cause, at least twice within six months, as one major incident where they collectively meet the criteria.

Article 19 requires the classification to support the report, so write the decision down at triage, criterion by criterion, with the timestamp captured automatically. An undocumented classification cannot be evidenced.

Third-party risk: Articles 28, 29 and 30

Article 28(3) requires a register of information covering every contractual arrangement for the use of ICT services, made available to the competent authority on request. The templates prescribed by Commission Implementing Regulation (EU) 2024/2956 ask for fields most procurement systems do not hold, from the entity layer through to sub-outsourcing, so lead time on the register is set by data collection.

Concentration risk sits in Article 29, headed preliminary assessment of ICT concentration risk at entity level. It asks whether the provider is easily substitutable, whether multiple arrangements run with the same or closely connected providers, and what a complex subcontracting chain does to supervision.

Microsoft's own DORA documentation records that on 18 November 2025 the ESAs published the list of designated critical ICT third-party providers, and that Microsoft Ireland Operations Limited is identified as a CTPP subject to the oversight mechanism. A tenant running Microsoft 365 or Azure under a critical or important function is therefore contracting with a designated CTPP. Record that designation, with its date, in the Article 29 assessment.

Article 30(2) lists the clauses every ICT contract must carry. Article 30(3) adds obligations for services supporting critical or important functions: performance targets, participation in threat-led penetration testing, unrestricted rights of access, inspection and audit, and exit strategies with a transition period. Map an existing contract against both, clause by clause; 30(3) is where the gaps sit.

Testing, and who has to run a threat-led penetration test

Articles 24 and 25 set the standard testing programme for every in-scope entity, from vulnerability assessments through source-code reviews, scenario-based tests and penetration testing. Read Article 25(1) for the full enumeration before scoping.

Threat-led penetration testing under Articles 26 and 27 applies to entities identified by the competent authority. Commission Delegated Regulation (EU) 2025/1190, adopted under Article 26(11) and published in the Official Journal in June 2025, sets the identification criteria entity type by entity type, and most of them are quantitative: payment institutions exceeding EUR 150 billion in total payment transaction value over the two preceding financial years, electronic money institutions exceeding EUR 40 billion in outstanding electronic money, plus status-based categories including G-SIIs, other systemically important institutions, CCPs and CSDs, significant trading venues operating an electronic trading system, and significant insurance and reinsurance undertakings. Read Article 2 against your own figures. The determination still rests with the competent authority under Article 26(8) of DORA, so a reading that places you outside the criteria stays a working assumption until the authority says otherwise.

Engagement prices are not published by the ECB or the ESAs, so budget a voluntary TIBER-EU style exercise from quotes you obtained yourself.

The evidence the regulation requires you to hold

Assemble this checklist before the first supervisory contact. The order follows the regulation's own filing obligations: artefacts DORA requires you to submit or make available on request come first, artefacts you must merely hold come second.

1. Register of information in the 2024/2956 templates, made available to the authority on request under Article 28(3).
2. Incident reports under Article 19, each with the classification rationale recorded against Articles 8 and 9 of Regulation 2024/1772.
3. ICT risk-management framework under Article 6, board-approved and dated.
4. Critical-provider contracts, with the Article 30(2) and 30(3) clauses mapped clause by clause.
5. Article 29 concentration assessment, with mitigations and owners.
6. Exit strategies per critical provider under Article 28(8), with the transition period stated.
7. Business impact analysis with tiered RTO and RPO per critical or important function.
8. Resilience testing programme under Article 24, and the prior period's results.
9. Internal audit reports produced under Article 6(6).
10. Training completion records by role, under Article 13(6).

Items 7 and 8 are the same artefact set a working backup and disaster recovery programme already produces, so an entity that runs restore tests is closer to the evidence bar than its framework document suggests.

Crosswalk with NIS2, ISO 27001 and GDPR

The Annex A references are to ISO/IEC 27001:2022. Control text is not reproduced, because that standard is published by ISO and is not freely available.

The anchors differ across the columns: NIS2 starts its early-warning clock at awareness of a significant incident, while DORA runs one leg from classification and caps it at awareness.

What the penalty exposure actually is

Article 35 permits periodic penalty payments of up to 1 percent of the average daily worldwide turnover of a designated critical ICT third-party provider, levied daily for up to six months, where that provider fails to comply with an oversight measure. The figure is calculated on the provider's turnover. Penalties for financial entities sit in Article 50, which requires administrative penalties and remedial measures to be effective, proportionate and dissuasive, lists the supervisory and investigatory powers available, and leaves the amounts to national law. A business case that applies the 1 percent figure to a financial entity's own turnover is reading Article 35 against the wrong party.

Recommendation

1. Re-anchor the incident procedure. Replace any deadline expressed as hours from detection, then run the function above against the last three incidents and check whether the procedure would have produced a compliant notification.
2. Write the classification SOP against Articles 8 and 9 of Regulation 2024/1772. Make the critical-services gate an explicit field on the incident record, and stamp the classification time automatically.
3. Populate the register of information in the prescribed templates. The templates ask for fields most procurement systems do not hold, so plan the schedule around data collection.
4. Run the Article 29 concentration assessment against the published CTPP list. Record the designation with its date, then write the substitutability analysis and the exit strategy for each critical provider.

Draft the framework document after the register. A framework written before the register exists describes an estate nobody has inventoried yet, and Article 6 requires it to cover the ICT assets and dependencies that only the register makes visible.

Trade-offs

• Independent control function against headcount. Outsourcing the review buys independence immediately and buys no institutional memory. An internal reviewer rotated out of operational ICT keeps the memory and needs a segregation argument that survives audit under the three lines of defence model referenced in Article 6(4). Microenterprises sit outside both Article 6(4) and Article 6(6).
• Amending contracts now against waiting for renewal. Amending mid-term costs negotiation capital and legal hours on a schedule the counterparty controls. Waiting for renewal is cheaper and leaves a documented gap in the interim, which the register makes visible to the supervisor.
• Voluntary threat-led testing against waiting for designation. A voluntary exercise costs real money against an obligation that may never arrive. Waiting means the first TLPT runs under a supervisory deadline with no rehearsal.

Where this does not apply

Article 2(3) puts a list of entities outside DORA altogether, among them managers of alternative investment funds under Article 3(2) of Directive 2011/61/EU, small insurance and reinsurance undertakings under Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members, and insurance intermediaries that are microenterprises or SMEs. Article 16 then replaces Articles 5 to 15 with a simplified ICT risk-management framework for five further categories, among them small and non-interconnected investment firms and payment or electronic money institutions exempted under Directive (EU) 2015/2366 or Directive 2009/110/EC. For those entities the Article 6 framework described above stops applying in the form set out here. Read both provisions in full before concluding either way.

Limitations

This is an engineering reading of published regulation, not legal advice, and no competent authority has reviewed it. Three boundaries matter.

National implementation. Penalty levels, the submission channel for the register of information, and the reporting portal are set by each competent authority. Nothing here tells you which portal to file into.

Sectoral overlay. Entities that are also essential or important under NIS2 carry parallel obligations with different anchors. The crosswalk table maps control areas. Filing obligations are separate, and one incident can trigger both regimes on two clocks.

Drift. DORA secondary legislation was still landing through 2024 and 2025, and ESA guidance continues to issue. Re-check each cited instrument against EUR-Lex before an audit.

The function omits the Article 5 weekend and bank-holiday extension by design, so it returns the earlier deadline in every case. That is the safe direction for an operational tool and the wrong direction for arguing that a filing was timely.

Last verified 2026-07-28. Article numbers, time limits and materiality thresholds checked against Regulations (EU) 2022/2554, 2025/301, 2024/1772, 2024/2956 and 2025/1190 on EUR-Lex. The CTPP designation and the Article 30 mapping were checked against Microsoft's published DORA documentation. The ISO/IEC 27001:2022 Annex A references are given without control text because that standard is not freely available. The function was executed on PowerShell 7.6.4 and the expected output above is its actual output.