<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-07-23","gaps":[],"covered":["ESMA Q&A 2241 — Q&A — Consultas relacionadas con el reporte de incidentes [Question Rejected] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes","title":"ESMA Q&A 2241 — Q&A — Consultas relacionadas con el reporte de incidentes [Question Rejected]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes","status":"question rejected","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 23 July 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2241","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"264b0f4075e670ae","change_date":null,"nearest_versions":["2024-07-23"],"first_text_date":null,"correction_applies":false,"versions":["2024-07-23"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes/versions/2024-07-23","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes/versions/2024-07-23/rev/264b0f4075e670ae","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2241-consultas-relacionadas-con-el-reporte-de-incidentes/relations","source_line":"Question published in the ESMA Q&A tool · no answer · not legislation [Question Rejected]","attribution":{"prepared_by":"not stated in the document","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"question_submitted_on":"2024-07-23","locators":{"question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2241, column 'Date of submission'"}},"adoption":null}}} -->
---
title: "ESMA Q&A 2241 — Q&A — Consultas relacionadas con el reporte de incidentes [Question Rejected]"
shortTitle: "ESMA Q&A 2241 — Q&A — Consultas relacionadas con el reporte de incidentes [Question Rejected]"
answer_id: ESMA_QA_2241
topic: "ICT-related incident"
status: "Question Rejected"
type: qa
instrument_type: qa
authority: ESMA
binding: false
binding_character: non_binding
legal_status: withdrawn
regulation: "DORA"
dora_level3: true
mica_level2: false
legal_basis: "DORA"
date: 23 July 2024
source_link: https://www.esma.europa.eu/publications-data/questions-answers/2241
lifecycle: "Question Rejected"
text_version: "ESMA Q&A register, 23 July 2024"
source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2241"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the ESMA publication"
source:
  prepared_by: "not stated in the document"
  published_by: "ESMA"
  published_in: "ESMA Q&A tool"
  evidence:
    prepared_by: "ESMA_QA_2241"
    locator: "ESMA Q&A entry ESMA_QA_2241: no answer; no author named"
document_type: "qa_question"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  question_submitted_on: "2024-07-23"
  locators:
    question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2241, column 'Date of submission'"
lifecycle_label: "Question Rejected"
---

**Question published in the ESMA Q&A tool · no answer · not legislation [Question Rejected]**

*Question Rejected · ESMA Q&A register, 23 July 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2241)*

| | |
|---|---|
| **Full title** | ESMA Q&A 2241 — Q&A — Consultas relacionadas con el reporte de incidentes \[Question Rejected\] |
| **Prepared by** | Not stated in the document |
| **Published by** | ESMA, in the ESMA Q&A tool |
| **Reference** | ESMA_QA_2241 |
| **Document type** | Q&A |
| **Legal nature** | No answer · not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Question submitted 23 July 2024 |
| **Legal basis** | DORA |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the ESMA publication |

**Consultas relacionadas con el reporte de incidentes**

### Question

Buenos días, me gustaría hacer dos consultas relacionadas con el reporte de incidentes:

En primer lugar, tras la publicación del segundo lote de RTS de DORA. En relación al RTS Final Report Draft Regulatory Technical Standards on the content of the notification and reports for major incidents and significant cyber threats and determining the time limits for reporting major incidents and Draft Implementing Technical Standards on the standard forms, templates and procedures for financial entities to report a major incident and to notify a significant cyber threats. Nos gustaría realizar dos consultas:

- Por una parte, se incluye, en el artículo 6 de los plazos de notificación para el reporte intermedio, las entidades financieras presentarán sin demora indebida un informe intermedio actualizado, en cualquier caso, cuando se hayan restablecido las actividades regulares. Por lo tanto, ¿se trata de un reporte obligatorio actualizar el informe intermedio bajo esa casuística?

- Por otro lado, en la RTS no se identifica a la autoridad competente a la que se debe de realizar los distintos reportes. En nuestro caso, España, tenemos como CSIRT de referencia INCIBE y también como autoridad competente BANCO DE ESPAÑA, ¿podríais comentarnos a quién es específico se deberían de realizar esos reportes, por favor?

En segundo lugar, aunque no se disponga de una relación estrecha con DORA, ha resultado también necesario Se elabora un informe semestral para la Autoridad Bancaria Europea (EBA) relacionado con los incidentes de ciberseguridad sufridos, con el propósito de llevar a cabo estudios estadísticos en el sector. ¿Podrías ayudarnos a confirmar si esta información es cierta y donde podríamos encontrar la referencia por favor?

***

**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2241)