ICT incident classification

Preamble (Recitals 1 – 18)

Recitals

Chapter I (Articles 1 – 7)

Classification criteria

Article 1

Clients, financial counterparts and transactions

Article 2

Reputational impact

Article 3

Duration and service downtime

Article 4

Geographical spread

Article 5

Data losses

Article 6

Criticality of services affected

Article 7

Economic impact

Chapter II (Articles 8 – 9)

Major incidents and materiality thresholds

Article 8

Major incidents

Article 9

Materiality thresholds for determining major incidents

Chapter III (Article 10)

Significant cyber threats

Article 10

High materiality thresholds for determining significant cyber threats

Chapter IV (Articles 11 – 12)

Relevance of major incidents to competent authorities in other Member States and details of reports to be shared with other competent authorities

Article 11

Relevance of major incidents to competent authorities in other Member States

Article 12

Details of major incidents to be shared with other competent authorities

Chapter V (Article 13)

Final provisions

Article 13

Entry into force

Article 3 Duration and service downtime

  1. Financial entitiesas defined in Article 2, points (a) to (t) shall measure the duration of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the incident occurs until the moment when it is resolved.

    Where financial entitiesas defined in Article 2, points (a) to (t) are unable to determine the moment when the incident occurred, they shall measure the duration of the incident from the moment it was detected. Where financial entitiesas defined in Article 2, points (a) to (t) become aware that the incident occurred prior to its detection, they shall measure the duration from the moment the incident is recorded in network or system logs or other data sources.

    Where financial entitiesas defined in Article 2, points (a) to (t) do not yet know when the incident will be resolved or are unable to verify records in logs or other data sources, they shall apply estimates.

  2. Financial entitiesas defined in Article 2, points (a) to (t) shall measure the service downtime of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the service is fully or partially unavailable to clients, financial counterparts or other internal or external users to the moment when regular activities or operations have been restored to the level of service that was provided prior to the incident. Where the service downtime causes a delay in the provision of service after regular activities or operations have been restored, the downtime shall be measured from the start of the incident to the moment when that delayed service is fully provided.

    Where financial entitiesas defined in Article 2, points (a) to (t) are unable to determine the moment when the service downtime started, they shall measure the service downtime from the moment it was detected.

Table of contents