One incident, several frameworks, one register.
Log the incident once and it is classified against DORA, NIS2, GDPR and the AI Act at the same time, with the criteria behind each verdict, on-screen countdowns and a downloadable draft per authority.
For: CISOs, compliance and continuity leads who, when an incident happens, must know whom to tell and by when, under several frameworks at once.
- Drafts are downloaded; you file them yourself
- Deadlines are guidance: confirm each framework's legal clock
Incident registerEntity A
Sample dataINC-0042 Outage of an ICT provider's payments service
InvestigatingDetected 09:12
Classified at once against each framework
- DORA
Reportable
Critical function affected and an outage of over 5 h
- NIS2
Reportable (indicative criteria)
High severity and a critical function affected
- GDPR
Not reportable
No personal data affected
- AI Act
Does not apply
No AI system involved
Deadlines from detection
DORA · initial report
Met
NIS2 · early warning
Pending14 h 48 min
DORA · intermediate report
Pending20 h 48 min
Deadlines are guidance. You confirm each framework's legal clock.
Downloadable drafts, one per authority
- DORA supervisorESA-style CSV
- NIS2 CSIRTMarkdown
- Data authorityArt. 33
From the alert to the draft for the authority
The path of an incident through HodeiShield, with what each step does not do.
Log it once
You create the incident with its type, severity and dates. It moves through open, investigating, contained, resolved and closed.
Scope. Writing takes an administrator role; the rest of the team can read.
It is classified against each framework
Deterministic rules assess DORA (with the thresholds of RTS EU 2024/1774), NIS2, GDPR and, if an AI system is involved, the AI Act. Each verdict shows the criteria that triggered it.
Scope. NIS2 criteria are indicative, set by HodeiShield. It is not an official classification and does not decide for you whether the incident is major.
You see each deadline with its countdown
It computes deadlines from detection: 4 h, 24 h and 72 h in DORA; 24 h and 72 h in NIS2; 72 h in GDPR. Each is shown as pending, overdue or met.
Scope. Deadlines are guidance. The legal clock, which in DORA runs from classifying the incident as major, is confirmed by your organisation. It does not warn you on its own before they expire.
You mark what is done
When your team has notified, you mark the deadline as met.
Scope. It is a human mark: it does not confirm that anything was filed.
You download each authority's draft
DORA: ESA-style CSV template (xBRL-CSV). NIS2: CSIRT notification in Markdown. GDPR: Article 33 form. AI Act: its own report. They are built from the incident data, without AI.
Scope. They are drafts. HodeiShield does not file them and the DORA file is not validated by the authority.
You close with root cause and measures
You attach evidence, record the root cause and measure mean time to detect (MTTD) and to resolve (MTTR).
What HodeiShield does and what stays yours
The boundary is clear: the product orders and prepares; the decision and the filing are your organisation's.
What it does
- Classifies against DORA, NIS2, GDPR and the AI Act at once.
- Shows each deadline with an on-screen countdown.
- Generates the draft in each authority's format.
- Takes the open deadlines to the virtual CISO and the board panel.
What stays yours
- Confirming each framework's legal clock.
- Deciding whether the incident is major or significant.
- Reviewing and filing the draft with the authority.
- Remembering the deadline: there are no automatic warnings before it expires.
How each verdict is decided
Deterministic rules, with the criteria in plain sight. DORA's follow the technical standard; NIS2's are indicative criteria.
- DORA
- Thresholds of RTS EU 2024/1774: users affected, percentage of users, outage duration, data records, financial loss and critical functions.
- NIS2
- Our own indicative criteria: high or critical severity, critical functions, cross-border impact, a prolonged outage and a high financial loss. They are not thresholds of the Directive.
- GDPR
- Flagged as reportable when personal data is affected and the severity warrants it.
- AI Act
- Applies to a serious incident involving a high-risk AI system (Article 73).
What it does not do
So you know where the tool ends.
- It does not file anything with the CSIRT, the supervisor or the data protection authority: it generates files that your organisation files on its own.
- It does not warn you on its own before a deadline expires: the countdown is on screen.
- It is not an official classification: they are rules with reference criteria, and NIS2's are indicative.
- It does not guarantee that the clock shown is the legal one: confirm it for each framework.
- It does not deliver a DORA file validated by the authority: it is an ESA-style template.
- It has no incident role matrix: an administrator role writes and the rest read.
How it connects to the other solutions
An open incident feeds the tracking and the reports for management.
- Virtual CISOOpen deadlines appear as obligations with their countdown.
- Board reportingOverdue obligations and open incidents are indicators on the board panel.
- DORAThe framework that asks the most of ICT incident classification and notification.
- NIS2The early warning and the notification of a significant incident.
Incident management: straight questions
The ones asked by people who must notify with the clock running.
Does HodeiShield notify the authority?
No. It generates the draft in each authority's format and you download it; your organisation files it on its own.
Are the deadlines it shows the legal ones?
They are shown as guidance, computed from detection. The legal clock may be counted differently (in DORA, from classifying the incident as major) and your organisation must confirm it.
Does it warn me before a deadline expires?
No. The countdown is on screen and open deadlines appear in the virtual CISO and on the board panel, but there are no automatic warnings.
Does it decide whether an incident is major or significant?
It does not decide for you. It applies rules with the criteria in plain sight: DORA's follow RTS EU 2024/1774 and NIS2's are indicative criteria set by HodeiShield, not thresholds of the Directive.
Which drafts does it generate, and does AI write them?
DORA as an ESA-style CSV template, NIS2 as a CSIRT notification in Markdown, GDPR as the Article 33 form and a report for the AI Act. They are built from the incident data, without AI, and each download is recorded in the audit log.
Who can log and edit incidents?
Administrator roles can write. The rest of the team reads, without an incident role matrix of its own.
See an incident classified under three frameworks
Request a demo and we walk through the register, the deadlines and the drafts for each authority, with sample data.
Indicative deadlines and downloadable drafts: the filing is yours.