inciclass

DORA / NIS2 incident classifier + notification clock — RTS 2024/1772 thresholds

v1.0.0
NixOS x86_64

Quick Start

Install via jcli

jcli install inciclass

Assess an incident

cat > incident.json <<'EOF'
{
  "case_id": "CASE-2026-014",
  "title": "Customer portal compromise via stolen IAM key",
  "detected_at": "2026-06-22T08:00:00Z",
  "engagement_id": "ENG-2026-014",
  "jurisdiction": "LU",
  "summary": "Stolen long-lived AWS access key. Detected via avwatch baseline-diff.",
  "downtime_minutes": 180,
  "member_states_affected": 2,
  "data_loss": "confidentiality,personal_data",
  "economic_impact_eur": 250000,
  "reputational_signals": "regulator,media",
  "critical_functions": "partial"
}
EOF

inciclass assess --input incident.json                    # human report
inciclass assess --input incident.json -F jfind           # jfind/v1 finding
inciclass clock --detected 2026-06-22T08:00:00Z --regime dora,nis2
inciclass report --input incident.json --stage initial    # initial-stage jfind

End-to-end pipeline (inciclass → jfind → complymap → dossier)

inciclass assess --input incident.json -F jfind > /tmp/inc.ndjson
complymap map /tmp/inc.ndjson -f dora,nis2 -o /tmp/mapped.json
dossier render /tmp/mapped.json --template incident --signed -o report.html

What it does

inciclass answers two questions the operator faces under DORA / NIS2 every time an ICT incident is detected:

  1. Is this a major / critical incident? Classified against the seven RTS 2024/1772 thresholds (clients/transactions affected · reputational impact · downtime · geographical spread · data losses · critical functions · economic impact).
  2. What deadlines do I have, and when do they expire? The DORA clock (initial ≤ 4h, intermediate ≤ 72h, final ≤ 1 month) and the NIS2 clock (early warning ≤ 24h, incident notification ≤ 72h, final ≤ 1 month).

Output flows through jfind/v1 into complymap (which pre-maps the finding to DORA Art. 17 / 18 / 19 + NIS2 Art. 23) and into dossier (which has a dedicated incident template).

Classification — RTS 2024/1772 criteria

IDTierCriterionMateriality barCritical threshold
C1primaryClients / counterparts / transactions affected≥ 10% clients OR ≥ 100k tx≥ 30% OR ≥ 500k tx
C2secondaryReputational impactmedia / regulator / complaintssustained adverse press / outflows
C3primaryDuration and service downtime≥ 120 min (2h)≥ 1440 min (24h)
C4primaryGeographical spread (Member States)≥ 2 MS≥ 4 MS
C5primaryData losses (AAIC)any AAIC property impactedpersonal data / client-financial
C6secondaryCritical / important functionspartial impairmentunavailable to clients
C7primaryEconomic impact (EUR)≥ €100k≥ €1m

Verdict logic: critical when ≥ 2 criteria score critical OR materiality count ≥ 2 with at least one critical; major when primary materiality count ≥ 2 OR a secondary criterion scores critical; otherwise minor. Thresholds live in data/dora_thresholds.json (auditable and bumpable).

Subcommands

CommandWhat it does
inciclass assessScore the incident against the seven criteria; emit verdict + per-criterion rationale + clocks. Output: human (default) / json / jfind.
inciclass clockCompute DORA + NIS2 deadlines from a detection timestamp. Output: human (table) / json. Exit 1 on any breached deadline.
inciclass report --stage initial|intermediate|finalEmit a per-stage jfind/v1 finding ready for the operator's regulatory submission.

Acceptance gate (Phase 3a)

Per the consulting-layer spec §4.1: a fixture incident that crosses two thresholds is classified major with both thresholds cited; clocks compute the 4h / 72h / 1 month (DORA) and 24h / 72h / 1 month (NIS2) deadlines correctly across a month boundary.

PASSED. Pinned by:

Exit codes

CodeMeaning
0Ok — minor incident, or no breached deadlines on clock
1Major or critical incident, OR clock found at least one breached deadline. Use in cron / CI to alert.
2Usage error (clap)
3Runtime — bad input JSON, bad RFC3339 timestamp, unknown regime / stage

Touches / Produces / Gates

Build from source

cd tools/inciclass/rust
cargo build --release        # ./target/release/inciclass
cargo test                   # 17 unit + 12 integration tests

Compliance crosswalk

This table lists controls where inciclass's output may form part of the evidence set presented to an assessor. It does not claim inciclass alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/inciclass/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

RefNameHowCoverage
Art. 17 ICT-related incident management process assess subcommand scores an incident against Art. 17 classification criteria. evidences
Art. 18 Classification & reporting of ICT-related incidents Explicit mapping of RTS 2024/1772 seven criteria + Below/Met/Critical rationale. evidences
Art. 19 Reporting timeline clock subcommand tracks 4h initial / 72h intermediate / 1m final DORA deadlines. evidences

NIS2 — NIS2 Directive (Dir. 2022/2555)

RefNameHowCoverage
Art. 23 Reporting obligations clock subcommand tracks 24h early-warning / 72h intermediate / 1m final NIS2 deadlines. evidences

RTS-2024-1772 — Commission Delegated Regulation on ICT-incident classification

RefNameHowCoverage
Art. 1 Clients / financial-counterparties / transactions affected assess criterion 1. evidences
Art. 2 Reputational impact assess criterion 2. evidences
Art. 3 Duration + service downtime assess criterion 3. evidences
Art. 4 Geographical spread assess criterion 4. evidences
Art. 5 Data losses assess criterion 5. evidences
Art. 6 Criticality of services affected assess criterion 6. evidences
Art. 7 Economic impact assess criterion 7. evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.