Incident Reporting to Multiple Authorities

A major ICT incident may need to be reported to more than one authority when the firm is authorised in more than one sector or member state, when it belongs to a group with several regulated entities, or when the incident touches services supervised by different authorities. Each report follows its own route, but all of them should describe the same incident, with the same core facts, even where each authority needs a different emphasis. Consistency matters because authorities may compare notes, and a firm whose reports diverge will face questions that a single consistent account would have avoided.

Multiple authorities become involved because supervision follows authorisation, not the incident. A group with a bank in one member state and an insurer in another may have two competent authorities with an interest in the same provider outage, if that outage affects both entities. A firm with activities across sectors may similarly fall under more than one supervisor. In addition, DORA provides for information sharing between authorities, so a report sent to one authority may legitimately reach others through supervisory channels. The firm should therefore assume, from the start, that its account may be read by more than one authority, and write it in a way that survives that wider readership.

The practical approach is to maintain a single internal account of the incident, drawn from the log, and to derive each authority report from it. The core facts, the services affected, the groups affected, the chronology, the cause as understood, and the recovery position, should be the same in every version. Differences should be limited to emphasis and to entity specific detail, such as which regulated entity is reporting and which of its services were affected. A firm that drafts each report from scratch, with a different author and a different source, invites divergence. A firm that drafts from a single account, with one owner checking consistency across versions, keeps its story straight even under pressure.

Different authorities will naturally ask different questions, because their supervisory interests differ. One may focus on customer harm, another on market functioning, and a third on the provider relationship. The firm should answer each question on its merits, from the same factual base, rather than giving each authority only the part of the story that seems relevant to it. Where an answer is still uncertain, the firm should say so to each authority alike, because giving a firm answer to one authority and a cautious answer to another will create a discrepancy that is hard to explain later. Consistency does not mean identical wording. It means that no two versions contradict each other on a material fact.

Coordination of multiple reports should sit with a single owner, usually the reporting owner for the incident, who holds the reporting map and tracks each route. That owner checks that each report has been sent, that each phase is on schedule for each authority, and that corrections are sent to every authority that received the earlier version. Without that coordination, it is easy for one report to be updated while another is forgotten, so that authorities end up holding different versions of the same incident. The coordinator does not need to write every report personally, but does need to see every version before it goes out, at least in summary, to check for contradictions.

Group and provider dimensions add a further layer to multi authority reporting. Within a group, several entities may be affected by the same incident, and the group should coordinate its reports so that the incident is described consistently across entities, while each entity reports its own position. With providers, the firm should be careful not to repeat a provider's explanation to one authority as fact while giving a more cautious version to another, because the difference will be noticed. The discipline, in both cases, is the same. One factual base, one coordinator, and a check for consistency before any version is sent. A firm that maintains that discipline will find multi authority reporting demanding but manageable, rather than a source of avoidable trouble.