ICT risk and ICT-related incident management
This domain tests the ICT risk management framework, incident handling and the DORA reporting clock, including how to classify and escalate major incidents.
Core rules and concepts
- The ICT risk management framework must identify, protect, detect, respond and recover, and include business continuity, backup, redundancy and crisis communication arrangements. It is reviewed at least annually.
- Incident management must detect, manage, classify and report ICT-related incidents. Classification uses criteria such as affected clients, duration, data losses, criticality and economic impact.
- For a major incident, the initial notification goes to the competent authority without undue delay and within four hours of classification, and no later than 24 hours after detection. An intermediate report follows within 72 hours of the initial notification; the final report within one month of the initial notification.
- Significant cyber threats may be notified voluntarily. Root-cause analysis and lessons learned feed back into controls.
Worked example
An incident is detected at 09:00 and classified as major at 11:00. The initial notification deadline is 15:00: four hours after classification is earlier than 24 hours after detection (next day 09:00). The intermediate report is due 72 hours after the initial notification, and the final report one month after that initial notification. The reasoning matters because candidates often start the clock at detection only.
Traps that cost marks
- Counting the initial deadline from detection instead of the earlier of the two limits.
- Reporting every incident as major, or waiting for full root cause before the initial notification.
- Overlooking incidents at ICT third-party providers that affect the entity.
- Treating business continuity as separate from ICT risk management.