Unknown affected figures under Article 1(5)

The financial entity shall estimate numbers or amounts based on available data from comparable reference periods.

Reputational impact under Article 2(1)

It has occurred where at least one listed criterion is met: media reflection, repetitive complaints, actual or likely regulatory non-compliance, or actual or likely material loss of clients or counterparts.

Incident duration under Article 3(1)

From when the incident occurs until it is resolved, subject to the specified detection, log-record, and estimation rules.

What is affected client?

For Article 1(1), an affected natural or legal-person client who was unable to use the financial entity's service during the incident or was adversely impacted; the count also includes explicitly covered contractual beneficiaries.

What is service downtime?

Under Article 3(2), the period of full or partial service unavailability until restoration to the pre-incident level of service, with a special rule for delayed service provision.

What is incident duration?

Under Article 3(1), the period from occurrence until resolution, subject to specified rules when occurrence, resolution, or records are uncertain.

Regulation 2024/1772: Incident Classification Foundations and Initial Criteria — Commission Delegated Regulation (EU) 2024/1774 and Related DORA Secondary Legislation: An Advanced Deep Dive

1. Orientation: What This Regulation Does

The instrument

Commission Delegated Regulation (EU) 2024/1772 supplements DORA with regulatory technical standards for classifying ICT-related incidents and cyber threats, setting thresholds, and reporting major incidents.

This lesson's focus

Articles 1 to 3 explain how to count affected people and transactions, assess reputational impact, and measure incident duration and service downtime.

Current status

As of August 17, 2026, Regulation 2024/1772 is in force. The listed corrigenda affect Regulation 2024/1774 rather than the provisions taught here.

2. Recitals (1)-(4): Why Classification Is Structured This Way

Harmonisation

Recital (1) says "the classification criteria and the materiality thresholds for determining major incidents and significant cyber threats should be specified in a simple, harmonised and consistent way".

Proportionality

Recital (2) says "the classification criteria and the materiality thresholds should reflect the size and overall risk profile, and the nature, scale and complexity of the services of all financial entities".

Absolute threshold

Recital (2) says "an absolute threshold mainly targeted at larger financial entities should be set out" to address incidents affecting many clients without exceeding another applicable threshold.

3. Article 1(1)-(3): Count the People and Relationships Affected

Affected clients

Under Article 1(1), the number shall reflect "all affected clients, whether natural or legal persons, that are or were unable to make use of the service provided by the financial entity during the incident or that were adversely impacted by the incident."

Contractual beneficiaries

Article 1(1) adds that the number shall also include third parties explicitly covered by the client contract as beneficiaries of the affected service.

Counterparts and relevance

Article 1(2) counts contractual financial counterparts. Article 1(3) requires consideration of business-objective effects and potential effects on market efficiency.

4. Thought Exercise: Who Belongs in the Client Count?

Apply Article 1(1)

A mobile-banking outage prevents 800 retail account holders from using the app. A corporate client cannot initiate payroll through the affected service. The corporate contract expressly identifies 50 employees as beneficiaries of a payroll-information feature, and they cannot access that feature during the outage.

Pause and decide: Which groups belong in the Article 1(1) affected-client count?

The 800 retail account holders
The corporate client
The 50 expressly identified employee beneficiaries
A journalist who cannot access a public news page but has no client relationship

Answer: Include groups 1, 2, and 3 if they satisfy the Article 1(1) conditions. The retail and corporate clients were unable to use the service. The 50 employees are included because they are third parties explicitly covered by the contractual agreement as beneficiaries of the affected service. The journalist is not included merely because a public page was unavailable.

This is an illustrative scenario. Article 1(1) requires a fact-based assessment of whether each person is an affected client or an explicitly covered beneficiary.

In the scenario, which additional group must be considered in the affected-client count because of Article 1(1)?

The 50 employees explicitly covered in the corporate contract as beneficiaries of the affected service
Any member of the public who saw news coverage of the outage
Only the financial entity's internal IT staff
No one beyond the named corporate client

Show Answer

Answer: A) The 50 employees explicitly covered in the corporate contract as beneficiaries of the affected service

Article 1(1) states that the number shall also include third parties explicitly covered by the contractual agreement between the financial entity and the client as beneficiaries of the affected service.

5. Article 1(4)-(5): Transactions and Estimation

Broad transaction scope

Recital (4) states: "All transactions that involve assets whose value can be expressed in a monetary amount should be considered for classification purposes."

Union connection

Under Article 1(4), the financial entity shall take into account all affected transactions involving a monetary amount where at least one part of the transaction is carried out in the Union.

Estimating unknown figures

Where actual figures cannot be determined, Article 1(5) says "the financial entity shall estimate those numbers or amounts based on available data from comparable reference periods."

6. Knowledge Check: Transaction Estimation

Choose the best answer

Focus on the conditions in Article 1(4) and Article 1(5).

A financial entity cannot determine the actual number and monetary amount of affected transactions during an outage. What does Article 1(5) require?

Wait until exact figures become available before assessing the criterion
Estimate the numbers or amounts based on available data from comparable reference periods
Exclude all transactions from the classification assessment
Use an estimate only if every transaction was fully carried out in the Union

Show Answer

Answer: B) Estimate the numbers or amounts based on available data from comparable reference periods

Article 1(5) requires estimation where actual affected-client, counterpart, or transaction figures cannot be determined. The estimate must be based on available data from comparable reference periods.

7. Article 2: When Reputational Impact Has Occurred

The mandatory test

Article 2(1) says "financial entities shall consider that a reputational impact has occurred where at least one of the following criteria is met:"

Four alternatives

The alternatives are media reflection, repetitive complaints, actual or likely inability to meet regulatory requirements, and actual or likely loss of material clients or counterparts.

Visibility

Under Article 2(2), financial entities shall take into account the visibility the incident has gained or is likely to gain in relation to each Article 2(1) criterion.

8. Example: Apply the Reputational-Impact Test

Scenario

A client portal fails. There is no media story, but different institutional clients repeatedly complain and a major client may leave with a material business impact.

Apply Article 2(1)

Repetitive complaints may meet Article 2(1)(b). Likely loss of a material client may meet Article 2(1)(d). Only at least one criterion is needed.

Do not stop there

Article 2(2) still requires the firm to take into account the visibility gained or likely to be gained in relation to each applicable criterion.

9. Article 3: Incident Duration Versus Service Downtime

Incident duration

"Financial entities shall measure the duration of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the incident occurs until the moment when it is resolved."

Unknown start or end

If occurrence is unknown, measure from detection. If earlier occurrence is shown by logs or other data, measure from the recorded moment. Where required facts remain unknown, Article 3(1) says estimates shall be applied.

Service downtime

Downtime runs "from the moment the service is fully or partially unavailable" until regular activities or operations return to the pre-incident level of service.

Delayed service

If a service remains delayed after operations are restored, Article 3(2) measures downtime from the start of the incident until that delayed service is fully provided.

10. Fast Review: Classification Foundations

Flip each card

Use these cards to distinguish the Article 1, Article 2, and Article 3 rules.

Affected clients under Article 1(1): All affected natural or legal-person clients who were unable to use the service during the incident or were adversely impacted, plus explicitly covered contractual beneficiaries.
Affected transactions under Article 1(4): All affected transactions involving a monetary amount where at least one part of the transaction is carried out in the Union.
Unknown affected figures under Article 1(5): The financial entity shall estimate numbers or amounts based on available data from comparable reference periods.
Reputational impact under Article 2(1): It has occurred where at least one listed criterion is met: media reflection, repetitive complaints, actual or likely regulatory non-compliance, or actual or likely material loss of clients or counterparts.
Incident duration under Article 3(1): From when the incident occurs until it is resolved, subject to the specified detection, log-record, and estimation rules.
Service downtime under Article 3(2): From full or partial unavailability until restoration to the pre-incident level of service; where a delay remains, until the delayed service is fully provided.

Key Terms

affected client: For Article 1(1), an affected natural or legal-person client who was unable to use the financial entity's service during the incident or was adversely impacted; the count also includes explicitly covered contractual beneficiaries.
service downtime: Under Article 3(2), the period of full or partial service unavailability until restoration to the pre-incident level of service, with a special rule for delayed service provision.
incident duration: Under Article 3(1), the period from occurrence until resolution, subject to specified rules when occurrence, resolution, or records are uncertain.
reputational impact: An impact that Article 2(1) requires financial entities to consider as having occurred where at least one listed criterion is met.
financial counterpart: For Article 1(2), an affected financial counterpart that has concluded a contractual arrangement with the financial entity.
comparable reference periods: Periods for which available data can be used under Article 1(5) to estimate affected-client, counterpart, or transaction numbers or amounts when actual figures cannot be determined.