An incident rarely stops at an organisational boundary.

The European Supervisory Authorities published their first annual overview of major ICT incidents reported through DORA. The report covers 3,383 incidents and identifies a cross-border dimension in around one third of them. System failures and external events were important causes, while cybersecurity incidents represented a smaller share. The publication examines reported major incidents, rather than estimating every outage or attempted attack across the sector.

Editorial interpretation: build an incident exercise around dependencies and customer impact, not just an attacker. Ask who receives the first signal, which countries or services are affected, and how teams establish a shared timeline. Recovery coordination is a skill worth practising explicitly.

A question for your next team meeting

What would we need to verify before this changes our workflow?