Operational resilience regulation

DORA's four-hour notification clock begins the moment a bank calls an incident major

Year two of the EU's operational resilience rules moves the test from documented governance to demonstrated detection. The reporting deadline runs from the entity's own classification decision, and the evidence behind that call is the SOC's.