Art.17 ICT-related incident management process
Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents, including early warning indicators, procedures to identify/track/log/categorise incidents by priority and severity, roles and responsibilities, and communication plans.
Source: DORA (Regulation (EU) 2022/2554), Art.17. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.
Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Documented ICT incident management process with logging, categorisation and roles · Policy repository / GRC workspace
First move
Common gaps auditors find
- No structured incident management process
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.16 Simplified ICT risk management framework · Art.18 Classification of ICT-related incidents and cyber threats