---
title: "DORA ICT Incident Reporting — Article 19 + classification RTS — KYE Protocol™ coverage"
description: "DORA ICT Incident Reporting — Article 19 + classification RTS coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/dora-ict-incident/
lang: en
source: "KYE Protocol"
---

> DORA ICT Incident Reporting — Article 19 + classification RTS coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

DORA ICT Incident Reporting — Article 19 + classification RTS

# DORA ICT Incident Reporting — Article 19 + classification RTS — 100% of in-scope requirements covered.

4 requirements · 3 in scope (3 enforced) · 1 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

**Source:** The Digital Operational Resilience Act (Regulation (EU) 2022/2554) requires financial entities to detect, manage, classify, and report major ICT-related incidents to competent authorities (Article 19), on a staged initial / intermediate / final report timeline, with root-cause analysis. KYE Protocol™ governs whether an AI-assisted containment action / incident classification / disclosure-timing decision under DORA may PROCEED to a consequential incident action — under a named accountable officer's authority, with chain-of-custody recorded for incident evidence, with a signed Evidence Pack™, and a contestability record so the decision can be reconstructed and challenged. KYE™ does not detect the threat, run the SIEM/EDR, perform forensics, or determine the technical response. · **License:** DORA is an EU legislative act published in the Official Journal of the European Union; KYE™ registry paraphrases each requirement's intent and cites the official article identifier for mapping purposes only.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Named-authority on the containment / response action | 1 | 1 | 0 | 0 | 0 | **100%** |
| Incident-evidence chain-of-custody & report integrity | 1 | 1 | 0 | 0 | 0 | **100%** |
| Disclosure-timing authority on the staged reporting clock | 1 | 1 | 0 | 0 | 0 | **100%** |
| Threat detection, forensics & remediation engineering | 1 | 0 | 0 | 0 | 0 | **0%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `dora-ict-incident.containment-action-authority` | An AI-assisted containment / response action proceeds only under a recorded named-authority decision | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:cyber-resilience-incident` **dictionaries**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `dora-ict-incident.incident-evidence-integrity` | Incident evidence proceeds only with a recorded chain-of-custody and integrity record | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` **engines**: `internal` **rule\_packs**: `kye:rule-pack:cyber-resilience-incident` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `dora-ict-incident.staged-report-timing-authority` | Disclosure-timing on the staged reporting clock proceeds only under a recorded named-authority decision, contestable in a post-incident inquiry | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.pack.v1`, `kye.replay.context_seal.v1`, `kye.replay.proof.v1` **engines**: `internal`, `internal`, `internal` **rule\_packs**: `kye:rule-pack:cyber-resilience-incident` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `dora-ict-incident.threat-detection-forensics-remediation` | Threat detection, forensics, and remediation engineering | out-of-scope | _(no enforcement cited)_ |

Canonical KYE™ surfaces referenced on this page: [Evidence Pack™](https://kyeprotocol.com/evidence-pack/) · [KYE Protocol™](https://kyeprotocol.com/).