The Financial Supervisory Authority of Norway has updated its guidance on incident reporting under DORA, clarifying when firms must submit status reports and a final report after a serious ICT-related incident. It has also changed the Altinn incident reporting form so firms can enter a future date for the planned completion of remedial measures or for when the incident is expected to be finally resolved. The first status report must be submitted as soon as possible when there are material changes in the status of the incident or its handling, and no later than 72 hours after the initial notification, even if there are no changes. Further status reports must be sent without undue delay when there are relevant updates, when normal operations have been restored, and when requested by the Financial Supervisory Authority of Norway. The final report must be filed once the root cause has been identified and actual impact figures are available to replace estimates, and no later than one month after the last status report. Remedial actions do not need to be completed before the final report is submitted. In the Altinn form, fields 4.7 and 4.8 now allow future dates for when the root causes are planned to be handled and when the incident is expected to be resolved.
Norwegian Finanstilsynet 2026-05-08
The Financial Supervisory Authority of Norway updates DORA incident reporting guidance and clarifies 72 hour status reporting and one month final report deadlines
The Financial Supervisory Authority of Norway has updated its guidance on incident reporting under the Digital Operational Resilience Act, clarifying when firms must submit status and final reports following serious ICT-related incidents. It specifies timelines and triggers for initial and subsequent status reports, confirms that remedial actions need not be completed before the final report, and updates the Altinn incident reporting form to allow firms to enter future dates for handling root causes and expected resolution.