The classic trap
Recital 53 sheds light on a critical point of DORA articles 17 to 19: all financial entities must report, but not with the same thresholds or timelines. In practice, many Luxembourg entities (small support PFS, sub-threshold AIFMs, insurance intermediaries) underestimate their obligation by thinking the RTS thresholds do not concern them. The CSSF on the contrary sanctions the absence of an incident qualification process, regardless of size: not knowing whether an incident is major is in itself a breach of article 17.
What this recital concretely imposes
Recital 53 guides the reading of the RTS adopted by the ESAs (notably Delegated Regulation 2024/1772 on classification and thresholds). Three operational obligations follow:
- Calibrate your own internal qualification thresholds mirroring the RTS criteria: clients affected, downtime, data loss, economic impact, reputation, criticality of service.
- Adapt your internal escalation timelines to meet regulatory windows: initial notification within 4 hours after major classification (and no later than 24h after detection), intermediate report within 72h, final report within 1 month.
- Document the specificity of your entity (size, business model, critical ICT services) to justify your calibration to the CSSF in case of inspection.
The main trap: mechanically applying RTS thresholds without contextualising them to your profile. Recital 53 on the contrary calls for reasoned and documented proportionality.
How Luxgap automates this risk
Our Luxgap Incident Severity Engine turns ICT incident qualification, a subjective and often late exercise, into an automatic timestamped decision aligned with DORA RTS. The tool plugs an AI agent into your telemetry sources (Microsoft Defender, Sentinel, CrowdStrike, Wazuh, Splunk, ServiceNow ITSM) and your business systems (core banking, AIFM platform, insurance CRM) to compute in real time the materiality score against the seven criteria of Delegated Regulation 2024/1772, with no human intervention at the critical moment.
- Detects automatically each ICT incident raised by your EDR, SIEM and ITSM tools and qualifies it against the seven RTS criteria in under 60 seconds.
- Computes the regulatory window applicable to your entity (4h, 24h, 72h, 1 month) and triggers timestamped Teams or Slack alerts to the CISO, DPO and executive committee.
- Pre-fills the CSSF eDesk form with mandatory fields extracted from your systems (clients impacted, services affected, measured downtime).
- Documents your threshold calibration specific to your entity profile with written justification opposable to the CSSF.
- Produces an incident dossier cryptographically sealed (eIDAS timestamp) covering the full detection-qualification-notification chain, opposable during an on-site inspection.
- Retroactively simulates your last 24 months of incidents to identify those that should have been notified but were not.
Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real incidents, with a free 48h blank audit to measure your reporting exposure before any commitment.
