Plans: Plus, an add-on on Starter and Core, and the free trial. Who: owners and admins set up DORA; any member classifies an incident and records filings; the approvers you name approve.
Set the company up as a financial entity
1
Open the DORA settings
Go to Reports → DORA. The page explains who DORA applies to and how reporting works, and holds the DORA settings. Only owners and admins can change them.
2
Choose the kind of financial entity
Under Kind of financial entity, choose what the company is, as in DORA Art. 2(1) and field 1.4 of Finanstilsynet’s form. The list includes the Norwegian firm types that DORA-forskriften brings under the incident rules from 1 September 2026, such as financing undertakings and debt collection agencies. Not a financial entity leaves DORA off.
3
Set the weekend rule and the LEI
Tick No weekend rule for the initial notification and the intermediate report if Finanstilsynet has told you the rule doesn’t apply to you (Art. 5(6)), or you are an essential or important entity under NIS2. It is always so for credit institutions, central counterparties and trading venues (Art. 5(5)). Enter the company’s 20-character LEI, which fills field 1.3 of the reports.
4
Save
Select Save DORA settings.
On Starter and Core, an owner adds DORA triage under Settings → Billing for 3 000 NOK / month, excl. VAT. See plans.
Classify an incident
Open the incident’s DORA tab. Until a classification is recorded, it reads Not classified yet. The form follows Delegated Regulation (EU) 2024/1772 Art. 8: an incident is major when critical services are affected, and either a malicious access that may lose data happened or two or more materiality thresholds are met.1
Tick the critical services affected (Art. 6)
A major incident needs at least one:
- ICT services supporting critical or important functions
- Authorised or supervised financial services
- Malicious access: a successful, malicious and unauthorised access to the network and information systems
2
Tick the materiality thresholds met (Art. 9)
Two are needed, unless the malicious access may lead to data losses. The thresholds as the app describes them:
3
Read the suggestion and choose the classification
Pharus shows what the ticks add up to, for example “Pharus suggests major: a critical service is affected, and two or more thresholds are met.” Under Classification, choose Yes — major ICT-related incident or No — not major. The choice is yours.
4
Link recurring incidents, if any
For a major classification, you can tick Classify recurring incidents with the same apparent root cause together (Art. 8(2)), pick the earlier incidents, and give the Number of occurrences and the First occurrence (Oslo time), within the 6 months before this incident. The rule doesn’t apply to microenterprises or to financial entities under the simplified ICT risk management framework (DORA Art. 16(1)).
5
Set the times
Classified at (Oslo time) is when you concluded this: a major incident’s initial notification counts from it. Fill in Aware of the ICT-related incident (Oslo time) only if that differs from the incident’s awareness time. The classification can’t be before the company became aware, and neither time can be in the future.
6
Write the rationale and pick approvers
Write what you know and why you conclude this (at least 10 characters). Under Required approvers, pick the colleagues who must approve. Tick I understand this entry can’t be changed afterwards and select Record classification.
Four-eyes approval
You can’t approve your own classification. The approvers you pick are asked by email and approve or decline on the DORA tab. Without approvers, the classification takes effect immediately. Once every approver has approved, it is In force; a declined one has no effect, and someone records a new one. While a major classification awaits approval, its deadline already counts from the classification time. The clock shows “awaiting approval”, and the reports can be marked as submitted once it is approved. Any other classification awaiting approval changes nothing until every approver has approved.Kept apart from the CRA determination
The DORA classification is a record of its own, with its own revisions and approvals. Approving or declining one never touches the other: a major DORA incident can be one the CRA doesn’t make reportable, and the other way round. The classification sets only the DORA row on the Routing tab: Triggered when major, Not applicable when not. A CRA determination that finds the incident not reportable doesn’t close it while DORA still needs handling.What a major classification starts
Once a major classification is in force, DORA is triggered, the incident shows the badge Major (DORA), and the DORA tab says: “DORA is triggered: report to Finanstilsynet before the deadlines.” The Deadlines card on the tab, and the clocks in the incident’s header, show three reports:
These follow DORA Art. 19(4) and Delegated Regulation (EU) 2025/301 Art. 5. Until the report before it is submitted, a clock reads “Starts when the initial notification is submitted” or “Starts when an intermediate report is submitted”.
The weekend rule. When a time limit falls on a weekend or a Norwegian public holiday, Pharus moves it to 12:00 Oslo time on the next working day, and shows “Moved by the weekend rule from” the original time. For credit institutions, central counterparties, trading venues, and a company that ticked the setting above, only the final report moves.
Pharus warns before each report is due: one hour before the initial notification, 4 hours before the intermediate report, and 72 hours before the final report, which is warned by email only. See notifications.
Report to Finanstilsynet from the Notices tab
Select Open the Finanstilsynet pack on the Deadlines card, or open the Notices tab and pick DORA. The pack follows Finanstilsynet’s reporting template (Implementing Regulation (EU) 2025/302) and is in English, as Finanstilsynet encourages: the labels stay in English whatever language you use Pharus in. You report in Altinn, “DORA Hendelsesrapportering” (KRT-3190). For each later report, open your last submission in Altinn and choose “Lag ny kopi”: that is why the intermediate and final report packs hold only their own fields and the type. The tab links to Open the form in Altinn and Finanstilsynet’s Guidance. Pharus fills in what it knows:
Times are in the template’s format, in UTC to the second. Some fields become required only when a criterion is met, for example the reputational impact fields once Reputational impact is ticked. If the company’s kind of financial entity has no choice of its own in field 1.4, the pack says so: ask Finanstilsynet which to choose.
To file:
1
Complete the pack
Select Edit pack, write the fields Pharus can’t fill in, and select Save pack. Clear a field to use the auto-filled value again.
2
Copy each field into Altinn
Paste the values into the form and submit it there. Pharus never files for you.
3
Record the submission and the reference
Select Mark as submitted and set Submitted at (Oslo time). When Finanstilsynet’s receipt arrives, select Record reference and enter it. The next report’s clock starts from the submission.
Reclassify as non-major
Reclassify as not major only if the incident at no time met the criteria. An incident that stops having impact is still major. If you record and approve a not-major classification after the initial notification is on file, the DORA tab asks you to file a reclassification with Finanstilsynet, and the Notices tab gets a Reclassification pack (Implementing Regulation (EU) 2025/302 Art. 5). In Altinn, open your last submission and choose “Lag ny kopi”. Field 1.1 says “Major incident reclassified as non-major”, and field 2.10 gives the reasons, taken from the rationale of the classification in force. The reclassification has no deadline.Check recurring incidents every month
While DORA is on, Reports → DORA also shows the Monthly check for recurring incidents: the incidents of the last 6 months classified as not major (Delegated Regulation (EU) 2024/1772 Art. 8(2)). If some share the same apparent root cause and together meet the criteria, classify the latest of them again as major and link the others. Any member can select Record this month’s check. Unless the rule doesn’t apply to your kind of entity, the page warns when no check is recorded for the current month.Switch DORA off
If the company is no longer a financial entity, an owner or admin selects Switch DORA off under Reports → DORA. This works on every plan, also in a read-only workspace. What is already recorded stays, and so does the LEI. Open DORA incidents keep their filings and deadlines, deadlines no longer move off weekends and holidays, new incidents get no DORA assessment, and new DORA classifications are refused. If the plan no longer includes DORA, new incidents get no DORA classification, but DORA work already triggered goes on: you can still file its reports, and classifications already recorded can still be approved.Related
Norwegian notices
GDPR and digitalsikkerhetsloven next to the CRA.
Decision record
The CRA determination and its approvals.
Reporting clocks
How Pharus counts deadlines from awareness.
Plans
What Plus includes, and the DORA add-on.