Article 15 Digital Operational Resilience Act (DORA), ICT-Related Incident Management Process

Effective incident detection and management are critical components of ICT risk management for financial entities. Establishing robust processes to detect, manage, and notify relevant parties about ICT-related incidents ensures prompt response and mitigation, thereby minimizing the potential impact on operations and services. This section outlines the key elements and specific requirements for ICT incident management.

Incident Management Process

Financial entities must create and enforce a comprehensive process for managing ICT-related incidents. This process should encompass several key areas:

• Detection: Implement early warning indicators to alert the entity to potential issues before they escalate into significant incidents. This involves continuous monitoring of ICT systems to identify anomalies and potential threats.

• Management: Develop a structured approach to handle ICT-related incidents effectively. This includes having predefined procedures and protocols to manage incidents from detection to resolution.

• Notification: Establish clear protocols for notifying relevant parties about ICT-related incidents. This includes internal staff, external stakeholders, and regulatory authorities, ensuring timely and accurate communication.

Integrated Monitoring and Handling

Financial entities are required to implement consistent and comprehensive processes for monitoring, handling, and following up on ICT-related incidents. This integrated approach ensures that:

• Root Causes Are Identified: Analyzing incidents to understand their root causes helps in preventing recurrence. This involves a thorough investigation of incidents to uncover underlying issues.

• Issues Are Addressed: Once root causes are identified, appropriate measures must be taken to address these issues. This might involve patching vulnerabilities, updating security protocols, or improving system configurations.

Specific Requirements For Incident Management

The ICT-related incident management process must include several specific elements to ensure thorough and effective management of incidents:

• Identification and Classification:

• Procedures: Establish procedures to identify, track, log, categorize, and classify ICT-related incidents. This should be done based on the priority, severity, and criticality of the affected services, in line with the criteria outlined in Article 16(1).

• Tools: Utilize tools and technologies that support the identification and classification process. These tools should be capable of automating parts of the process to ensure efficiency and accuracy.

• Roles and Responsibilities:

• Definition: Clearly define and assign roles and responsibilities for different types of ICT-related incidents and scenarios. This ensures that appropriate actions are taken by the right personnel.

• Training: Provide regular training to staff to ensure they understand their roles and responsibilities during an incident. This includes simulated drills and exercises to prepare for real-world scenarios.

• Communication Plans:

• Internal and External: Develop communication plans for informing staff, external stakeholders, and the media as specified in Article 13. This includes notifying clients, establishing internal escalation procedures for ICT-related customer complaints, and providing information to counterpart financial entities as needed.

• Templates and Protocols: Create templates and protocols for communication to ensure consistency and clarity in messaging during incidents.

• Reporting and Informing Management:

• Reporting: Major ICT-related incidents must be reported to relevant senior management. This ensures that the management body is aware of significant issues that may impact operations.

• Informing: Inform the management body about the incidents, including their impact, the response actions taken, and any additional controls established to prevent future incidents. Regular updates and post-incident reviews should also be communicated to senior management.

• Incident Response Procedures:

• Implementation: Implement ICT-related incident response procedures to mitigate the impact of incidents. These procedures should be well-documented and accessible to relevant staff.

• Restoration: Ensure that services are restored to operational and secure status promptly. This involves coordination among different teams to bring systems back online safely and securely.

• Continuous Improvement: Review and refine incident response procedures regularly based on lessons learned from past incidents. This continuous improvement approach ensures that the entity’s incident management capabilities evolve with emerging threats.

Effective ICT incident management is vital for maintaining the operational resilience of financial entities. By establishing comprehensive processes for detecting, managing, and notifying relevant parties about ICT-related incidents, financial entities can mitigate the impact of these incidents and ensure continuity of services. Integrated monitoring, clear roles and responsibilities, robust communication plans, and well-defined incident response procedures are key components of a successful incident management framework. Continuous improvement through regular reviews and updates to the incident management process ensures that financial entities remain prepared to handle evolving ICT risks and challenges.