Law / European Union

DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents)

Regulation (EU) 2022/2554, Article 17

In force since 17 Jan 2025.

A sector security regimes rule binding private bodies.

Private right of action

No

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, such as a credit institution, payment institution, electronic money institution, investment firm, crypto-asset service provider, central counterparty or trading venue, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). Article 16(1) disapplies Articles 5 to 15 for the small entities it names, and Article 17 is not among them. The duties apply from 17 January 2025 (Article 64).
• Define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents (Article 17(1)).NIST CSF 2.0ID.IM-04
• Record all ICT-related incidents and significant cyber threats, and establish procedures and processes that ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents so that root causes are identified, documented and addressed (Article 17(2)).NIST CSF 2.0RS.AN-06NIST CSF 2.0RS.AN-03
• In the process, establish procedures to identify, track, log, categorize and classify ICT-related incidents according to their priority and severity and the criticality of the services impacted, in accordance with the criteria set out in Article 18(1) (Article 17(3)(b)).NIST CSF 2.0RS.MA-03
• In the process, put in place early warning indicators, assign roles and responsibilities for different incident types and scenarios, set out plans for communication and internal escalation, make sure at least major ICT-related incidents are reported to relevant senior management and to the management body, and establish response procedures to mitigate impacts and make services operational and secure in a timely manner (Article 17(3)(a) and (c) to (f)).NIST CSF 2.0RS.MA-04

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.

NIST CSF 2.0

• ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
• RS.MA-03Incidents are categorized and prioritized
• RS.MA-04Incidents are escalated or elevated as needed
• RS.AN-03Analysis is performed to establish what has taken place during an incident and the root cause of the incident
• RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

CIS Controls

• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.

FINOS AIGF

• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest
• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance

1 more

• AIR-DET-001AI Data Leakage Prevention and Detection

ENISA NIS2 guidance

• 2.1Risk management framework
• 3.1Incident handling policy
• 4.1Business continuity and disaster recovery plan
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure

2 more

• 9.1Cryptography
• 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app