# Major-incident reporting support

When a financial entity classifies an ICT-related incident as major under DORA, it reports in three stages against hard deadlines, and its ICT third-party providers are expected to help. Mirror's help is built from evidence the bank already holds, not from Mirror's account of its own outage.

## The three clocks

`mirror-incident.deadlines({ aware_at, classified_at, initial_sent_at, intermediate_sent_at, final_sent_at, now })` computes each stage as `not_started`, `due`, `on_time` or `late`, from stated times only:

| Stage | Deadline, as we read the incident-reporting technical standards |
|---|---|
| Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it |
| Intermediate report | Within 72 hours of the initial notification |
| Final report | Within one month of the latest intermediate report |

The calculator does **not** apply the relief some entities have when a deadline falls on a weekend or a holiday. Confirm the limits against the current text with counsel. **Not legal advice.**

## What the rail did while the incident ran

`mirror-incident.facts({ from, to, records, observed })` counts, over the **signed records the member already holds** for the window (verdicts, recall notices, deliveries, each verified first):

- how many there are, by record type;
- by verdict, and by undetermined reason;
- the first and last record in the window.

A record that does not verify is set aside and counted, never included. Error codes the member observed in its own logs are carried separately and labelled as unsigned.

To get those records:

- the [SIEM export](/sdk.md), whose lines point at signed records;
- the webhook deliveries you received;
- your own copies of every verdict.

For **what did not reach you**, use the operator's signed receipts (every leg it received is acknowledged) and the absence proofs (`/absence/prove`).

## What stays with the entity

- **The classification.** "Is this major?" is the financial entity's call.
- **The report.** It is the entity's report, to its competent authority.
- **The pack.** `mirror-incident.pack()` assembles the deadlines and the facts into one record for the entity's incident file. It says so in its own disclaimer.