ICT incident classification

Preamble (Recitals 1 – 18)

Recitals

Chapter I (Articles 1 – 7)

Classification criteria

Article 1

Clients, financial counterparts and transactions

Article 2

Reputational impact

Article 3

Duration and service downtime

Article 4

Geographical spread

Article 5

Data losses

Article 6

Criticality of services affected

Article 7

Economic impact

Chapter II (Articles 8 – 9)

Major incidents and materiality thresholds

Article 8

Major incidents

Article 9

Materiality thresholds for determining major incidents

Chapter III (Article 10)

Significant cyber threats

Article 10

High materiality thresholds for determining significant cyber threats

Chapter IV (Articles 11 – 12)

Relevance of major incidents to competent authorities in other Member States and details of reports to be shared with other competent authorities

Article 11

Relevance of major incidents to competent authorities in other Member States

Article 12

Details of major incidents to be shared with other competent authorities

Chapter V (Article 13)

Final provisions

Article 13

Entry into force

Article 2 Reputational impact

  1. For the purposes of determining the reputational impact of the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, financial entitiesas defined in Article 2, points (a) to (t) shall consider that a reputational impact has occurred where at least one of the following criteria is met:

    1. the incident has been reflected in the media;

    2. the incident has resulted in repetitive complaints from different clients or financial counterparts on client-facing services or critical business relationships;

    3. the financial entity will not be able to or is likely not to be able to meet regulatory requirements as a result of the incident;

    4. the financial entity will or is likely to lose clients or financial counterparts with a material impact on its business as a result of the incident.

  2. When assessing the reputational impact of the incident, financial entitiesas defined in Article 2, points (a) to (t) shall take into account the level of visibility that the incident has gained or is likely to gain in relation to each criterion listed in paragraph 1.

Table of contents