DORA Major ICT Incident Reporting
The DORA incident-reporting surface prepares major ICT-related incident classification output and signed handoff artifacts for customer/operator use. Stella provides deterministic classification, reporting timeline milestones, local report encoders, and filesystem handoff support; the financial-entity operator remains the reporting party.
This is a surface of the DORA Operational Resilience Pack.
Claim boundary: operator-support.
Source Docs
- Assurance Reporting Timeline v1
- DORA Incident Classification v1
- DORA Major Incident Report v1
- DORA Incident Taxonomy Completion Procedure
- Assurance Setup Prerequisites v1
- Notify architecture
- DORA incident CLI guide
- DORA gap-closure research
Runtime Boundary
Telemetry Core owns the deterministic seven-criteria classifier over frozen incident facts, tenant compliance profile values, and telemetry snapshots. Notify owns the shared timeline regime and the major-incident outbound filesystem handoff adapter. CLI owns offline classify, export, and verify commands over local inputs.
The default outcome is a signed, replayable operator handoff. Auto-submit is default-off and requires a tenant/channel authorization snapshot, fresh approval, and a configured delivery path. The connector does not call Authority directly and must fail closed if approval or readiness is missing.
Timeline
Runtime regime id: dora.
Target Assurance timeline profile id: dora.article19.incident.
| Milestone | Timeline milestone | Due within | Evidence keys |
|---|---|---|---|
| Initial report | initial_report | PT4H from opened event | incident_opened_event_ref, dora_major_incident_classification_ref |
| Intermediate report | intermediate_report | PT72H from opened event | incident_classified_event_ref, intermediate_report_bundle_ref, operator_approval_ref |
| Final report | final_report | P1M from opened event | final_report_bundle_ref, initial_report_payload_hash, intermediate_report_payload_hash, operator_approval_ref |
The shared Notify runtime route is GET /api/v1/regulatory/reporting-timelines?regime=dora. The generic Assurance timeline profile endpoint must not report this profile as configured until dora.article19.incident is registered with readiness checks.
Handoff Artifacts
stella export dora-incident-report produces a deterministic variant directory containing:
- XBRL report artifact;
- inline XBRL report artifact;
- local report envelope;
- DSSE signed envelope;
- handoff manifest with artifact hashes.
Supported variants are initial, intermediate, and final.
stella verify dora-incident-report replays the manifest, artifact hashes, DSSE payload binding, and local HMAC signature offline. The local HMAC path is an offline tamper check. It is not a production CAdES/KMS signature or proof of regulator receipt.
Schema Status
The local encoder is pinned to dora-major-incident-report.v1 and local validation rule set dora-major-incident-report-local-validation-v1.
Official EBA schema validation is not finished by waiting for the abandoned eba-dora-incident-reporting-framework-4.3 asset. Engineering already re-verified that Framework 4.3 is the wrong asset for DORA major-incident reporting. To finish official taxonomy validation, follow the completion procedure: first decide whether a correct DORA-IR machine-validation package exists, then perform legal and asset intake, then wire Notify/CLI validation against local bytes only. Until that procedure lands, docs and UI must describe the output as a local-contract handoff, not a fileable official XBRL package.
Blocking Conditions
Do not treat a handoff as ready for filing when:
- the tenant profile is missing LEI, jurisdiction, or DORA financial-entity status;
- the incident is not classified as a major incident;
- any required DORA criterion object is absent;
- an operator approval reference is missing for a report variant that requires approval;
- artifact hashes or DSSE payload binding fail verification;
- the operator expects auto-submit but the channel opt-in, authorization snapshot, or fresh-auth evidence is missing.