Major incident classification and reporting clock after a cloud network outage
Atlas Trading is an EU investment firm with 210,000 retail clients. On Tuesday its online trading platform became unavailable at 09:10 after a cloud provider network misconfiguration. Detection was automatic. The incident was classified as major at 11:30. Service was restored at 11:50, with no data loss and no unauthorised access. During the outage 18,000 clients could not place orders, representing 8.5% of active clients; the firm estimates €420,000 in lost commission and 1,200 client complaints. The platform is not the only channel: clients could trade by phone, but only 40% of them knew that. The incident log records 'provider issue, no breach'. The head of compliance asks whether the firm must report the incident to the competent authority, and by when. The firm has a DORA reporting template but no pre-approved contact point.
1. Determine whether the incident should be classified as a major ICT-related incident under DORA. Identify the criteria you would apply and any facts you still need.
Read the worked answer
Classification is holistic, not a single threshold. Under DORA, major incident criteria include clients and financial counterparts affected, duration and service downtime, geographic spread, data losses, criticality of the affected service, economic impact, and reputational impact. Here the trading platform is a critical channel; 18,000 clients (8.5% of active clients) could not place orders for 2 hours 40 minutes; estimated lost commission is €420,000; and 1,200 complaints suggest customer harm. The lack of data loss or unauthorised access does not make it non-major.
I would still confirm: the firm's internal classification thresholds and the applicable RTS; whether the phone channel was an effective substitute for all clients or only some; whether any clients suffered financial loss beyond inconvenience; whether other entities or markets were affected; and whether the incident met the competent authority's criteria for major. On the facts, a major classification is likely and should be documented. The error to avoid is treating 'provider issue, no breach' as automatically below threshold.
2. Assume it is a major incident. Set out the reporting timeline from detection and classification, and what the initial notification should contain.
Read the worked answer
Detection was 09:10; classification was 11:30. DORA requires the initial notification without undue delay, within 4 hours of classification and in any event within 24 hours of detection. The earlier controlling deadline is 15:30 on the same day. A detailed report follows within 72 hours, and a final report within one month, subject to the applicable RTS and competent authority portal.
The initial notification should state: the entity and contact point; the time of detection and classification; the type of incident; the services and clients affected; the estimated impact; whether the incident is ongoing or restored; the known or suspected cause at that stage; the measures taken; and cross-border or third-party involvement. It does not need a final root cause. The firm should submit what it knows, mark unknowns clearly, and update later. Missing the 15:30 deadline because the team is waiting for the cloud provider's report would be a governance failure, not a valid excuse.
3. What governance failure does the missing pre-approved contact point reveal, and what should be fixed?
Read the worked answer
It reveals that the incident response plan is a document, not an operating capability. DORA expects communication plans, defined roles, escalation paths and tested reporting arrangements. A template without a named reporting owner, backup contact and competent authority portal access is not sufficient.
Fix: designate a reporting owner and deputy in compliance or operations; pre-register users on the authority's reporting channel; keep an up-to-date contact list for internal and external parties; define who can classify and who can approve notification; test the process at least annually and after changes; and brief the board on reporting obligations. The firm should also log the decision and timeline. The lesson is that incident reporting is a controlled process with deadlines, not an administrative task left to whoever is available.