meta_id 3137384

On the date of this update, Norway's Financial Supervisory Authority (Finanstilsynet) updated its guidance on incident reporting under the Digital Operational Resilience Act (DORA). The update clarifies reporting deadlines for serious information and communication technology (ICT)-related incidents and introduces functionality for reporting planned remediation dates. The Financial Supervisory Authority has specified the following reporting deadlines for firms experiencing serious ICT-related incidents. Initial status reports must be submitted as soon as possible upon substantial changes to incident status or handling, and no later than 72 hours after initial notification—even when no changes have occurred. Subsequent status reports should be submitted without undue delay when relevant updates occur, when normal business operations have been restored, or upon request from the Financial Supervisory Authority. Final incident reports must be submitted once the root cause has been identified and actual impact figures are available to replace estimates. Notably, remedial measures need not be completed before submitting the final report. Final reports must be submitted no later than one month after the last status report was sent. Additionally, the Financial Supervisory Authority has enhanced the Altinn reporting form for DORA incident reporting. Firms can now enter future dates in fields 4.7 (date and time when incident root causes were addressed) and field 4.8 (date and time when the incident was resolved) to indicate planned completion of remedial measures or expected final resolution dates. Firms subject to DORA should review the updated guidance and ensure their incident reporting procedures align with the clarified deadlines and new functionality. **Reference:** Finanstilsynet, Hendelsesrapportering etter DORA