DORA Article 10: detection, and the exact numbers that make an incident "major"¶
Article 9 was about keeping attackers out. Article 10 accepts that some get in, and asks whether you would notice. It is short, but it connects to the most consequential numbers in the whole regulation: the thresholds in RTS 2024/1772 that decide when an incident stops being an internal matter and becomes something you must report to your supervisor. Today, detection and classification.
Article 10: would you notice?¶
Article 10 requires "mechanisms to promptly detect anomalous activities", including "ICT network performance issues and ICT-related incidents", and to identify "potential material single points of failure". Those mechanisms have to be tested regularly under Article 25. Paragraph 2 wants "multiple layers of control", defined "alert thresholds and criteria to trigger and initiate ICT-related incident response processes", and automatic alerting of the staff responsible for response.
The phrase to sit with is "define alert thresholds". DORA does not accept "we monitor everything" as an answer. It wants you to have decided, in advance, what level of what signal starts your incident process. If your SOC cannot state its thresholds, it does not really have any.
Classification: the six criteria¶
Detection feeds classification, and classification is where DORA gets specific. Article 18(1) lists the six criteria every entity uses to judge an incident's impact: the number and relevance of clients or counterparts affected and any reputational impact, the duration and service downtime, the geographical spread across Member States, data losses touching availability, authenticity, integrity or confidentiality, the criticality of services affected, and the economic impact in absolute and relative terms.
Those are the criteria. The thresholds that turn them into a yes or no live one level down, in RTS 2024/1772.
The numbers that trigger reporting¶
This is the part worth pinning to the wall. An incident is major under RTS 2024/1772 when it crosses the higher-impact thresholds. The clients and transactions test is met when, among others, affected clients exceed 10 percent of all clients using the service, or the affected clients number more than 100,000, or affected financial counterparts exceed 30 percent, or affected transactions exceed 10 percent of the daily average.
The duration test is met when the incident lasts longer than 24 hours, or service downtime exceeds 2 hours for ICT services supporting critical or important functions. Two hours. That is not much time to decide whether your outage has become a regulatory event. The geographical test is met when two or more Member States are affected. The economic test is met when costs and losses have exceeded or are likely to exceed 100,000 euro.
Read the 2-hour and 100,000 euro numbers together and you see the design: DORA wants incidents surfaced early, on operational impact, not after the finance team has finished counting. If you wait for certainty, you have already missed the clock.
The artefact: a classification quick reference¶
Pin this next to the incident process. Any one of these crossing is a strong signal to start major-incident handling.
| Criterion (DORA Art. 18(1)) | Major when, per RTS 2024/1772 |
|---|---|
| Clients affected | More than 10% of clients on the service, or more than 100,000 clients |
| Financial counterparts | More than 30% affected |
| Transactions | More than 10% of daily average number or value |
| Duration | Longer than 24 hours |
| Downtime (critical or important functions) | Longer than 2 hours |
| Geographical spread | Two or more Member States |
| Economic impact | Exceeds or likely to exceed 100,000 euro |
One caution worth stating plainly: this is the practitioner's short form, not the legal text. Before you rely on a threshold in anger, read RTS 2024/1772 itself, linked from the DORA resource library, because several criteria carry conditions and cross-references this table cannot hold.
Next in this series: Articles 11 and 12, business continuity and backup, where DORA tells you what "recover" actually has to mean.