Two CSSF circulars restructure Luxembourg's DORA incident-reporting transition. Neither requires independent verification of the detection, classification, or resolution timestamps entities self-report.

Detection, classification, and notification under DORA are each fixed by the entity being audited, not by an independent third party. SOURCE 0 examines what a genuine seal would change.

3,383 major ICT incidents, one joint ESA report, and a methodology section that quietly admits the data is incomplete and not yet fully validated. This article examines what it means that the reference benchmark regulators now cite was built entirely from entities' own self-declared accounts of themselves.

DORA requires a bank to prove when it became aware of an incident and when it classified it as major — the two instants a regulator disputes most. Both are written exclusively by the bank itself. This article examines why TLPT, Article 6 internal audit, and third-party oversight do not supply an independent witness to either instant, and what a pre-execution, third-party-deposited fixation adds to the DORA timeline.