Cyber threats
DORA requires financial entities to assess whether a cyber threat – a potential event that has not yet materialised into an incident – is significant (Article 18(2)), and allows a voluntary notification to FI (Article 19(2)).
1. Register
Open Cyber threat and describe the threat: title, source, time of detection, other relevant timestamps, description, status (Active, Monitoring, Mitigated, Closed) and changes in threat activity.
2. Assess significance
CDR (EU) 2024/1772 Article 10. The threat is significant only when all three conditions are met:
- (a) Could it, if materialised, affect critical or important functions of the financial entity, or other financial entities, third-party providers, clients or financial counterparts?
- (b) Does it have a high probability of materialisation? Document (i) exploitable vulnerabilities and applicable risks, (ii) the threat actor's capabilities and intent, and (iii) the persistence of the threat and related incidents already seen.
- (c) Could it, if materialised, meet the criticality-of-services criterion, the clients, counterparts and transactions threshold, or the geographical-spread threshold? Other thresholds may be noted (Article 10(2)).
Press Save and assess to store the threat in your browser and see the result.
3. Notification content
CDR (EU) 2025/301 Article 6: potential impact (d), preventive actions (g), notifications to other entities or authorities (h), indicators of compromise (i) and other information (j). Detection (b), description (c), criteria (e) and status and changes (f) come from the registration and assessment. General information about the entity (a) comes from Settings.
4. Notify
FI has no file format for cyber-threat notifications. Use Copy as text or Download JSON and transfer the values into the "Dora Cyberthreats" form in Fidac. Keep the threat updated as it evolves; if it materialises, register it as an incident.