DORA and NIS2

Both regulations expect organisations to detect, record and report incidents. Alert tooling sits at the start of that chain. This page says what we have read and what we do not claim.

This is general information from public sources, not legal advice. Ackline does not make an organisation compliant with DORA or NIS2. Compliance is the responsibility of the organisation, and its own legal and compliance teams should interpret the texts.

DORA, incident handling

According to a secondary summary of Article 17 of the Digital Operational Resilience Act (Regulation (EU) 2022/2554), financial entities must define an ICT-related incident management process to detect, manage and notify incidents, record all such incidents, and have procedures to identify, track, log and classify them, with assigned roles and responsibilities. The article does not name alerting tools. See Springlex, DORA Article 17.

DORA, reporting clocks

The French regulator AMF summarises the major-incident reporting timeline as: an initial notification within 4 hours of classification and no later than 24 hours after detection, an intermediate report at 72 hours, and a final report within one month. See AMF, DORA.

These clocks depend on when something was detected and by whom. The time an alert was raised and the time a named person acknowledged it are useful inputs, which is why we record both.

NIS2

NIS2 (Directive (EU) 2022/2555) also contains incident reporting obligations; see Springlex, NIS2 Article 23. A secondary summary says DORA takes precedence for ICT risk and incident reporting in financial entities, while NIS2 can still matter depending on national law and the size of the organisation (Orbiq). Which regime applies to you is a question for your own advisers.

What Ackline records

• When an alert was received, and from which source.
• The routing decision, its inputs, and the notification level chosen.
• Each delivery attempt, with the evidence level reached (sent, delivered, seen).
• Acknowledgement: who, when, and by which method. Acknowledgement is final.
• Nothing is deleted; alerts are archived.

Audit entries are intended to be protected against later change. We will state exactly how once that has shipped.

What we do not claim

• We do not claim DORA or NIS2 compliance, certification or audit approval for Ackline or for its users.
• We hold no security certification and have no customers to cite.
• We do not claim a competitor lacks any feature beyond what a cited public page says.