--- title: "Article 17 — ICT-related incident management process" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 17 — ICT-related incident management process" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 17 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. Financial entities shall define, establish and implement an [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) management process to detect, manage and notify [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident). 2. Financial entities shall record all [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) and [significant cyber threats](https://www.headlesslaw.com/definitions/dora/significant-cyber-threat). Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident), to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents. 3. The [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) management process referred to in paragraph 1 shall: **(a)** put in place early warning indicators; **(b)** establish procedures to identify, track, log, categorise and classify [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in [Article 18(1)](18.md); **(c)** assign roles and responsibilities that need to be activated for different [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) types and scenarios; **(d)** set out plans for communication to staff, external stakeholders and media in accordance with [Article 14](14.md) and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate; **(e)** ensure that at least [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) are reported to relevant senior management and inform the [management body](https://www.headlesslaw.com/definitions/dora/management-body) of at least [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident), explaining the impact, response and additional controls to be established as a result of such [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident); **(f)** establish [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner. *** [Chapter III — ICT-related incident management, classification and reporting](../chapters/iii.md) · [← Article 16](16.md) · [Article 18 →](18.md)