DORA · the incident clock

Their clock starts when you tell them

Your contract
Their regulatory clock
0
Your side
Hour 0
You spot it

The problem is in your system. Their clock has not started yet.

!
Your side
Hours
You tell them

The contract sets this in hours. Every hour here comes out of their window.

1
First notice
4 hours
From classifying it as major

And never later than 24 hours after they became aware.

2
Intermediate
72 hours
Intermediate report

Counted from the first notification.

3
Final
1 month
Final report

Counted from the last intermediate report.

Source: Delegated Regulation (EU) 2025/301