Incident Management is the process of detecting, responding to, resolving and learning from unplanned disruptions to a service, such as an outage, a degraded payment flow or a security breach, with the aim of restoring normal service quickly and limiting harm to customers. Incidents move through detection, severity classification, response led by an incident commander, resolution and a blameless postmortem. Mitigation comes before root cause, for example failing over to a backup processor; finding the underlying cause is problem management. Performance is measured by mean time to detect and resolve and by payments at risk. Under DORA, financial entities must report major ICT incidents within 4 hours of classification and no later than 24 hours after becoming aware.
How does the incident management process work
Most frameworks follow the same sequence: detect, classify, respond, resolve, review. Detection comes from monitoring, alerts and provider health monitoring, or from customers. Classification assigns a severity level based on impact, for example SEV1 when card payments fail for all merchants and SEV3 when one report is delayed. Severity sets who is paged, how fast communications go out and whether regulators must be told.
During response, an incident commander coordinates while engineers diagnose. The first goal is mitigation, not root cause: switching traffic to a backup processor through failover restores payments faster than debugging the primary. After resolution, a blameless postmortem records the timeline, cause and follow-up actions.
How is a payment incident measured
Mean time to detect and mean time to resolve are the standard measures, along with business impact. A PSP processing €4 million an hour that loses card acceptance for 45 minutes has €3 million of payments at risk; some customers retry later, but abandoned purchases and breached SLAs with merchants are permanent costs.
DORA incident reporting requirements
Since 17 January 2025, the EU Digital Operational Resilience Act (DORA) requires banks, payment and e-money institutions, investment firms, CASPs and other financial entities to classify ICT-related incidents and report major ones. The initial notification is due within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial notification, and a final report within one month of the latest intermediate report. Payment-related incidents that payment firms used to report under PSD2 are now reported under DORA.
A data breach involving personal data can additionally require notification to the data protection authority within 72 hours under GDPR, so one incident may need two separate reports with two different clocks.
Incident management vs problem management
Incident management restores service; problem management finds and removes the underlying cause. A recurring timeout with an acquirer that is mitigated each time by failover is a series of incidents and one unresolved problem.
What buyers check
In due diligence on a licensed fintech, the incident register, DORA classification decisions, reports filed with the regulator and the status of postmortem actions show how resilient the platform really is. A pattern of repeated major incidents with the same cause signals technical debt the buyer will have to fund, and possible supervisory attention after completion.