Art. 1 General information to be provided in initial notifications and intermediate and final reports on major ICT-related incidents | RTS on incident reporting | DORA

This article establishes the general information that financial entities must include across all three types of major ICT-related incident reports — the initial notification, the intermediate report, and the final report — as required under Article 19(4) of DORA (Regulation (EU) 2022/2554).

It acts as a foundational baseline that applies consistently to all report types, covering identifying details about the reporting entity, the submitting entity, and key contact and contextual information.

Important points:

Include a standard set of general identifying information in every report, regardless of whether it is an initial notification, intermediate report, or final report.
Provide contact details for the person responsible for communicating with the competent authority about the major ICT-related incident.
Where applicable, disclose parent undertaking details, aggregated entity LEI codes, and the currency used for any monetary amounts reported.

Financial entities shall include in the initial notification, the intermediate report, and the final report, as referred to in Article 19(4) of Regulation (EU) 2022/2554, the following general information:

the type of submission (initial notification, intermediate report, or final report);
the name of the financial entity, its LEI code, and the type of financial entity, as referred to in Article 2(1) of Regulation (EU) 2022/2554;
the name and identification code of the entity that submits the initial notification, or intermediate or final report, for the financial entity;
where applicable, the names and LEI codes of all financial entities covered in the aggregated initial notification or intermediate or final report;
the contact details of the persons responsible for communicating with the competent authority on the major ICT-related incident;
where applicable, the identification of the parent undertaking of the group to which the financial entity belongs;
where there is monetary impact, the currency the amounts are based on.