All tabletop exercises
Outage / resilience·Intermediate·Executive audience
Classifying and reporting a major ICT incident under DORA
The prompt — read this to the room
At 07:15 on a Tuesday, your EU payment institution loses its core transaction database after a fault at the cloud provider that hosts it. Card authorisations are failing for about 40% of merchants across four member states. The provider's status page says 'degraded performance' and gives no estimate. By 09:00 your service desk has logged 2,300 merchant complaints. Your head of compliance asks the question nobody has answered yet: is this a major ICT-related incident under DORA, and if so, when did the clock start? The CEO wants to know what goes to the regulator, and when.
Total duration
1 h 30 min
People to involve
6
Best fit
Finance
Who to involve
Most important first.
- CIO / CTO
- CISO / Head of security
- Legal counsel
- CEO / Managing director
- Vendor / procurement manager
- Communications / PR
What it tests
- Apply the DORA classification criteria and record the classification decision and its time
- Produce an initial notification inside the regulatory window using only the facts available
- Manage the ICT third-party provider through the contract's incident and information clauses
- Plan the intermediate and final reports and the message to affected clients
Outline of activities
- 1Outage begins and the provider says little
- 2Classification against the DORA criteria
- 3Initial notification: content, owner, timing
- 4Provider management and the exit-plan check
- 5Intermediate report and client communication
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…