inciclass
DORA / NIS2 incident classifier + notification clock — RTS 2024/1772 thresholds
v1.0.0Quick Start
Install via jcli
jcli install inciclass
Assess an incident
cat > incident.json <<'EOF'
{
"case_id": "CASE-2026-014",
"title": "Customer portal compromise via stolen IAM key",
"detected_at": "2026-06-22T08:00:00Z",
"engagement_id": "ENG-2026-014",
"jurisdiction": "LU",
"summary": "Stolen long-lived AWS access key. Detected via avwatch baseline-diff.",
"downtime_minutes": 180,
"member_states_affected": 2,
"data_loss": "confidentiality,personal_data",
"economic_impact_eur": 250000,
"reputational_signals": "regulator,media",
"critical_functions": "partial"
}
EOF
inciclass assess --input incident.json # human report
inciclass assess --input incident.json -F jfind # jfind/v1 finding
inciclass clock --detected 2026-06-22T08:00:00Z --regime dora,nis2
inciclass report --input incident.json --stage initial # initial-stage jfind
End-to-end pipeline (inciclass → jfind → complymap → dossier)
inciclass assess --input incident.json -F jfind > /tmp/inc.ndjson
complymap map /tmp/inc.ndjson -f dora,nis2 -o /tmp/mapped.json
dossier render /tmp/mapped.json --template incident --signed -o report.html
What it does
inciclass answers two questions the operator faces under DORA / NIS2 every time
an ICT incident is detected:
- Is this a major / critical incident? Classified against the seven RTS 2024/1772 thresholds (clients/transactions affected · reputational impact · downtime · geographical spread · data losses · critical functions · economic impact).
- What deadlines do I have, and when do they expire? The DORA clock (initial ≤ 4h, intermediate ≤ 72h, final ≤ 1 month) and the NIS2 clock (early warning ≤ 24h, incident notification ≤ 72h, final ≤ 1 month).
Output flows through jfind/v1 into complymap (which pre-maps the
finding to DORA Art. 17 / 18 / 19 + NIS2 Art. 23) and into dossier (which has a
dedicated incident template).
Classification — RTS 2024/1772 criteria
| ID | Tier | Criterion | Materiality bar | Critical threshold |
|---|---|---|---|---|
| C1 | primary | Clients / counterparts / transactions affected | ≥ 10% clients OR ≥ 100k tx | ≥ 30% OR ≥ 500k tx |
| C2 | secondary | Reputational impact | media / regulator / complaints | sustained adverse press / outflows |
| C3 | primary | Duration and service downtime | ≥ 120 min (2h) | ≥ 1440 min (24h) |
| C4 | primary | Geographical spread (Member States) | ≥ 2 MS | ≥ 4 MS |
| C5 | primary | Data losses (AAIC) | any AAIC property impacted | personal data / client-financial |
| C6 | secondary | Critical / important functions | partial impairment | unavailable to clients |
| C7 | primary | Economic impact (EUR) | ≥ €100k | ≥ €1m |
Verdict logic: critical when ≥ 2 criteria score critical OR materiality
count ≥ 2 with at least one critical; major when primary materiality count
≥ 2 OR a secondary criterion scores critical; otherwise minor. Thresholds
live in data/dora_thresholds.json (auditable and bumpable).
Subcommands
| Command | What it does |
|---|---|
inciclass assess | Score the incident against the seven criteria; emit verdict + per-criterion rationale + clocks. Output: human (default) / json / jfind. |
inciclass clock | Compute DORA + NIS2 deadlines from a detection timestamp. Output: human (table) / json. Exit 1 on any breached deadline. |
inciclass report --stage initial|intermediate|final | Emit a per-stage jfind/v1 finding ready for the operator's regulatory submission. |
Acceptance gate (Phase 3a)
Per the consulting-layer spec §4.1: a fixture incident that crosses two thresholds is classified major with both thresholds cited; clocks compute the 4h / 72h / 1 month (DORA) and 24h / 72h / 1 month (NIS2) deadlines correctly across a month boundary.
PASSED. Pinned by:
acceptance_gate_two_thresholds_is_major_with_citations— exercises C3 + C4 → major, asserts each rationale string mentions the crossed threshold.clock_crosses_month_boundary_correctly— 2026-01-31 + 1 month = 2026-02-28.one_month_crosses_leap_february_correctly(unit) — 2028-01-31 + 1 month = 2028-02-29.
Exit codes
| Code | Meaning |
|---|---|
0 | Ok — minor incident, or no breached deadlines on clock |
1 | Major or critical incident, OR clock found at least one breached deadline. Use in cron / CI to alert. |
2 | Usage error (clap) |
3 | Runtime — bad input JSON, bad RFC3339 timestamp, unknown regime / stage |
Touches / Produces / Gates
- Touches (read-only): the incident JSON file you point it at, or stdin.
- Touches (write): only the
-o <PATH>destination. - Produces: human report / structured JSON / jfind/v1 finding.
- Gates: none. inciclass is fully offline — no network, no Anthropic API.
Build from source
cd tools/inciclass/rust
cargo build --release # ./target/release/inciclass
cargo test # 17 unit + 12 integration tests
Compliance crosswalk
This table lists controls where inciclass's output
may form part of the evidence set presented to an assessor. It does not
claim inciclass alone satisfies any framework — every
control still requires assessor judgment and typically evidence from other sources.
Schema: compliance-crosswalk/v1 ·
Machine-readable: tools/inciclass/compliance.json
DORA — Digital Operational Resilience Act (Reg. 2022/2554)
| Ref | Name | How | Coverage |
|---|---|---|---|
Art. 17 |
ICT-related incident management process | assess subcommand scores an incident against Art. 17 classification criteria. | evidences |
Art. 18 |
Classification & reporting of ICT-related incidents | Explicit mapping of RTS 2024/1772 seven criteria + Below/Met/Critical rationale. | evidences |
Art. 19 |
Reporting timeline | clock subcommand tracks 4h initial / 72h intermediate / 1m final DORA deadlines. | evidences |
NIS2 — NIS2 Directive (Dir. 2022/2555)
| Ref | Name | How | Coverage |
|---|---|---|---|
Art. 23 |
Reporting obligations | clock subcommand tracks 24h early-warning / 72h intermediate / 1m final NIS2 deadlines. | evidences |
RTS-2024-1772 — Commission Delegated Regulation on ICT-incident classification
| Ref | Name | How | Coverage |
|---|---|---|---|
Art. 1 |
Clients / financial-counterparties / transactions affected | assess criterion 1. | evidences |
Art. 2 |
Reputational impact | assess criterion 2. | evidences |
Art. 3 |
Duration + service downtime | assess criterion 3. | evidences |
Art. 4 |
Geographical spread | assess criterion 4. | evidences |
Art. 5 |
Data losses | assess criterion 5. | evidences |
Art. 6 |
Criticality of services affected | assess criterion 6. | evidences |
Art. 7 |
Economic impact | assess criterion 7. | evidences |
Release artefacts & provenance
Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.
-
manifest.json— pinned SHA-256 +.sigURL + SBOM URL per platform -
johlem-release.pub— Ed25519 public key used bysignify -V(fingerprint:4532510f…6748, pinned injcli verify) CHANGELOG.md— semver-tagged release notes- Security contact:
security@johlem.net