DORA Year Two: Can Your SOC Actually See the Attack?

Summary: DORA became enforceable across the EU in January 2025, and in its second year regulators are increasing focus on implementation, ICT incident analysis, and the effectiveness of ICT risk supervision. The article ties continuous monitoring to Article 9, anomaly detection and response thresholds to Article 10, third-party ICT risk to Articles 28 through 30, and major-incident reporting to Article 19, which requires initial notification no later than four hours after classification and no later than 24 hours after the organization becomes aware of the incident.
Key Takeaway: DORA's reporting clock starts at classification and caps initial notification at 24 hours from awareness, so a SOC that cannot scope an intrusion across legacy systems, unmanaged devices, and vendor connections is assembling the required incident record against a deadline it may not be able to see.

Read the original at The Hacker News ↗