ICT incident classification

Preamble (Recitals 1 – 18)

Recitals

Chapter I (Articles 1 – 7)

Classification criteria

Article 1

Clients, financial counterparts and transactions

Article 2

Reputational impact

Article 3

Duration and service downtime

Article 4

Geographical spread

Article 5

Data losses

Article 6

Criticality of services affected

Article 7

Economic impact

Chapter II (Articles 8 – 9)

Major incidents and materiality thresholds

Article 8

Major incidents

Article 9

Materiality thresholds for determining major incidents

Chapter III (Article 10)

Significant cyber threats

Article 10

High materiality thresholds for determining significant cyber threats

Chapter IV (Articles 11 – 12)

Relevance of major incidents to competent authorities in other Member States and details of reports to be shared with other competent authorities

Article 11

Relevance of major incidents to competent authorities in other Member States

Article 12

Details of major incidents to be shared with other competent authorities

Chapter V (Article 13)

Final provisions

Article 13

Entry into force

Recital 13

Considering that competent authoritiesas defined in Article 46 in other Member States are to be notified of incidents that impact financial entitiesas defined in Article 2, points (a) to (t) and customers in their jurisdiction, the assessment of the impact in another jurisdiction in accordance with Article 19(7) of Regulation (EU) 2022/2554 should be based on the root cause of the incident, on potential contagion through third-party providers and on financial market infrastructures, as well as on the impact of the incident on significant groupsa group as defined in Article 2, point (11), of Directive 2013/34/EU of clients or financial counterparts.
Table of contents