DORA

DORA Article 17 ICT-related incident-reporting workflow. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) Article 17 requires every "financial entity" subject to DORA to classify, document, and report ICT-related incidents according to the harmonized RTS template (Commission Delegated Regulation 2024/1772). The framework owns the classification rubric, the three-stage report shape (initial / intermediate / final), and the audit-chain integration; operators wire the produced RTS-template-shaped records into their submission code (channel + ESA / national-supervisor credentials are operator-specific — the framework does NOT submit on the operator's behalf).

Adjacent regimes (NIS2 Art. 23, CRA Art. 14, HIPAA breach notification) share the deadline-tracking shape; reference constants live on the module so operators don't pin literal hour counts in their reporters.

b.dora.create(opts) #

{
  audit:          boolean (default true; set false to skip audit emits),
  observability:  boolean (default true; set false to skip the
                 best-effort observability counter on report),
}

Build a DORA reporter handle exposing classify, report, and draftFinalReport. classify runs the RTS 2024/1772 Articles 1-12 thresholds (severity / affected clients / economic impact / geographic scope / duration / reputational / sensitive-data classes) and returns the regulatory tier ("major" / "significant" / "minor") plus a deadline hint. report validates and shapes the operator's payload into an RTS-template record carrying the nextStageDueAt deadline (Art. 19 — 24h initial / 72h intermediate / 30-day final). draftFinalReport clones a prior record into a Stage-final skeleton with the operator-fillable fields zeroed. Each call emits an audit row in the dora.* namespace.

var dora = b.dora.create({ audit: true });
var rv = dora.classify({
  dataAffected:       "financial",
  severityIndicator:  "critical",
  affectedClients:    1200,
  economicImpact:     { eur: 50000 },
  durationMs:         4 * 60 * 60 * 1000,
});
rv.classification;     // → "major"
rv.mustReport;         // → true

var initial = dora.report({
  incidentId:    "INC-2026-0042",
  classification: rv.classification,
  stage:         "initial",
  detectedAt:    Date.now(),
  description:   "Payment-gateway outage — 2h customer-facing impact",
});
initial.stage;         // → "initial"

Last updated 2026-08-08T16:39:49.652Z by seeder.