{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/17","url":"https://www.headlesslaw.com/dora/articles/17","title":"Article 17 — ICT-related incident management process","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"e3d05b2469b0b01f","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/17/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/17/versions/2022-12-27/rev/e3d05b2469b0b01f","versions_url":"https://www.headlesslaw.com/dora/articles/17/versions","relations_url":"https://www.headlesslaw.com/dora/articles/17/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"6d4e69b20318e135edecd6d1851d05ee590cbd8a05aaa8f899ee84fd02c03abf","markdown_sha256":"035699c162b37f4bc58f72930d085cac827ff38e0c6a2bebd704820d6e598d4c"},"units":[{"locator":"dora/art/17","kind":"article","status":"in_force","label":null,"heading":"ICT-related incident management process","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dora/art/17/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.","marks":[],"revision":1,"text_hash":"6d01fe26c6f319e493baddeb42234ddb64c4a895cb2ec27ed74f16f70eec9a23","reason":null},{"locator":"dora/art/17/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.","marks":[],"revision":1,"text_hash":"65117d1cab82555aaba6817806dfdd1892275fa2bc40cc02213214c88006efa4","reason":null},{"locator":"dora/art/17/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"The ICT-related incident management process referred to in paragraph 1 shall:","marks":[],"revision":1,"text_hash":"1d7a0cc27895cbed99d4c7f98c03a3f4a9d40e8272080629ea4b667fd2fa3ae7","reason":null},{"locator":"dora/art/17/para/3/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"put in place early warning indicators;","marks":[],"revision":1,"text_hash":"071a5b2dc08eb569fc0c2fe23d2c78234e90e1857851407309b260a3491bd380","reason":null},{"locator":"dora/art/17/para/3/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);","marks":[],"revision":1,"text_hash":"8c36d95afa8f1963d2c14d831e47656da930436d19127199f04e0ffeee472948","reason":null},{"locator":"dora/art/17/para/3/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;","marks":[],"revision":1,"text_hash":"8fa41fc6a13cfcd50951def10a1eaa90039a4b4bf2b615502d02dac67bcd1d42","reason":null},{"locator":"dora/art/17/para/3/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;","marks":[],"revision":1,"text_hash":"fee6ae4fc0ea054fcde466d55af9f490bb5eb1bb87aeaa8c9fb7ec83cb39a1f4","reason":null},{"locator":"dora/art/17/para/3/pt/e","kind":"point","status":"in_force","label":"(e)","heading":null,"text":"ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;","marks":[],"revision":1,"text_hash":"483aa15b02a88e8bae15a2cdb4a378f04b5f4a1c3cde438846890d3cb3f99899","reason":null},{"locator":"dora/art/17/para/3/pt/f","kind":"point","status":"in_force","label":"(f)","heading":null,"text":"establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.","marks":[],"revision":1,"text_hash":"0fb0d264b699d7224a80bf2600140ffacf245d44d94f0add0836243f130633d5","reason":null}],"markdown":"*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*\n\n1. <a id=\"p-1\"></a>Financial entities shall define, establish and implement an [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) management process to detect, manage and notify [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident).\n2. <a id=\"p-2\"></a>Financial entities shall record all [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) and [significant cyber threats](https://www.headlesslaw.com/definitions/dora/significant-cyber-threat). Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident), to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.\n3. <a id=\"p-3\"></a>The [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) management process referred to in paragraph 1 shall:\n\n    <a id=\"p-3-a\"></a>**(a)** put in place early warning indicators;\n\n    <a id=\"p-3-b\"></a>**(b)** establish procedures to identify, track, log, categorise and classify [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in [Article 18(1)](18.md);\n\n    <a id=\"p-3-c\"></a>**(c)** assign roles and responsibilities that need to be activated for different [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) types and scenarios;\n\n    <a id=\"p-3-d\"></a>**(d)** set out plans for communication to staff, external stakeholders and media in accordance with [Article 14](14.md) and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;\n\n    <a id=\"p-3-e\"></a>**(e)** ensure that at least [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) are reported to relevant senior management and inform the [management body](https://www.headlesslaw.com/definitions/dora/management-body) of at least [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident), explaining the impact, response and additional controls to be established as a result of such [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident);\n\n    <a id=\"p-3-f\"></a>**(f)** establish [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.\n\n***\n\n[Chapter III — ICT-related incident management, classification and reporting](../chapters/iii.md) · [← Article 16](16.md) · [Article 18 →](18.md)\n"}