{
  "id": "dora-major-incident-criteria",
  "title": "DORA major ICT-related incident classification",
  "description": "The gate test, materiality thresholds and decision rule of Commission Delegated Regulation (EU) 2024/1772.",
  "verified": "2026-10-19",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "attribution": "ClevSec (https://clevsec.one)",
  "disclaimer": "For informational purposes only; not legal advice. Check the cited sources and your national law.",
  "human_readable": "https://clevsec.one/blog/dora-major-incident-classification/?ref=agent",
  "sources": [
    "https://eur-lex.europa.eu/eli/reg_del/2024/1772/oj/eng",
    "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng"
  ],
  "decision_rule": "Major if critical services are affected (gate) AND either the threshold of Art. 9(5)(b) is met OR two or more of the other thresholds (Art. 9(1)-(4), 9(5)(a), 9(6)) are met. Art. 8(1).",
  "gate": {
    "criterion": "Critical services affected",
    "reference": "Art. 6",
    "met_when": [
      "affects ICT services or network and information systems supporting critical or important functions",
      "affects financial services that require authorisation or registration or are supervised",
      "constitutes a successful, malicious and unauthorised access to the network and information systems"
    ]
  },
  "sufficient_alone": {
    "criterion": "Malicious unauthorised access",
    "reference": "Art. 9(5)(b)",
    "met_when": "a successful, malicious and unauthorised access to network and information systems occurs that may result in data losses"
  },
  "other_thresholds": [
    {
      "criterion": "Clients, financial counterparts and transactions",
      "reference": "Art. 9(1)",
      "met_when": "more than 10% of clients using the affected service, or more than 100,000 clients; more than 30% of financial counterparts; more than 10% of daily average number or value of transactions; or clients or counterparts identified as relevant are affected"
    },
    {
      "criterion": "Reputational impact",
      "reference": "Art. 9(2), 2",
      "met_when": "media coverage; repetitive complaints from different clients or counterparts; likely failure to meet regulatory requirements; or likely loss of clients or counterparts with material impact"
    },
    {
      "criterion": "Duration and service downtime",
      "reference": "Art. 9(3)",
      "met_when": "duration longer than 24 hours, or downtime longer than 2 hours for ICT services supporting critical or important functions"
    },
    {
      "criterion": "Geographical spread",
      "reference": "Art. 9(4)",
      "met_when": "impact in two or more member states"
    },
    {
      "criterion": "Data losses",
      "reference": "Art. 9(5)(a)",
      "met_when": "an impact on availability, authenticity, integrity or confidentiality of data that adversely affects business objectives or the ability to meet regulatory requirements"
    },
    {
      "criterion": "Economic impact",
      "reference": "Art. 9(6)",
      "met_when": "costs and losses exceed, or are likely to exceed, EUR 100,000"
    }
  ],
  "limits": {
    "clients_percent": 10,
    "clients_count": 100000,
    "counterparts_percent": 30,
    "transactions_percent": 10,
    "duration_hours": 24,
    "downtime_hours": 2,
    "member_states": 2,
    "economic_eur": 100000,
    "note": "Each threshold is met when the value is higher than the limit, except member_states (two or more)."
  },
  "recurring_incidents": "Incidents not major individually count as one major incident if they occurred at least twice within 6 months, share the same apparent root cause and together meet the rule; assessed monthly; not applicable to microenterprises and Art. 16(1) entities (Art. 8(2))."
}