Incident Reporting Phases Under DORA

DORA incident reporting proceeds in phases, described in the applicable standard as initial, intermediate, and final phases. The initial phase gives early notice that a major incident has happened and what is known so far. Intermediate phases update that picture as the incident develops and the response progresses. The final phase gives the completed account, including the root cause analysis and the lessons drawn, once the incident is closed and the facts are established. Each phase has a different purpose, and a later phase is expected to correct or complete an earlier one rather than repeat it.

The initial phase is for early warning, not for a complete account. At that point the incident team may know what stopped and who was affected, but not yet why it happened or how long recovery will take. The report should therefore say what is known, what is still being checked, and what the firm is doing about it, without filling gaps with guesses. An authority reading an initial report needs enough to understand the scale of the event and to decide whether any immediate supervisory step is needed. It does not need a root cause that the firm has not yet established. A clear statement of uncertainty in an initial report is a strength, because it prevents a later correction from looking like a contradiction.

Intermediate phases track the incident as it moves. They report progress on restoration, changes in the affected services or groups, and any new facts that alter the picture given earlier. If the incident spreads, if recovery stalls, or if a workaround proves less effective than hoped, an intermediate update is the place to say so. If the incident is contained and recovery is progressing, the update should say that too, with the same plainness. The value of intermediate reporting lies in its rhythm. Regular, factual updates let an authority follow the incident without chasing the firm, and they let the firm show that it remains in control of the response even when the outcome is not yet known.

The final phase closes the reporting cycle with the fullest account the firm can give. It confirms the services affected, the duration and scale of the effect, and the root cause as established by the analysis. It also describes the actions taken to restore the service, the measures put in place to prevent recurrence, and the lessons the firm has drawn. Where the final account differs from earlier phases, it should explain the difference rather than silently replacing it, because the earlier phases were part of the record too. A final report that only describes the fix, without explaining the cause or the follow up, leaves the most important questions unanswered.

Phases help an incident team under pressure by breaking a large reporting duty into smaller, timed pieces. The team does not have to produce a perfect account at the moment of greatest stress. It has to produce a truthful early account, then improve it as facts arrive. That structure also helps the firm internally, because each phase creates a natural checkpoint for the service owner, the incident lead, and the person who signs the report to check that the account still matches the log. Firms that treat reporting as a single document at the end of the incident lose that checkpoint, and they often discover too late that the log and the report do not agree.

One common mistake is to delay the initial phase until the picture is complete, which defeats its purpose as early notice. Another is to copy the initial report forward unchanged through later phases, so the authority receives repetition instead of progress. A third is to treat the final phase as a formality and rush the root cause analysis, producing a cause that sounds plausible but has not been tested against the evidence. Each mistake comes from treating phases as administrative hurdles rather than as stages of understanding. A firm that sees each phase as answering a different question, what has happened, what is happening now, and what has been learned, will usually avoid all three.