ICT incident classification

Preamble (Recitals 1 – 18)

Recitals

Chapter I (Articles 1 – 7)

Classification criteria

Article 1

Clients, financial counterparts and transactions

Article 2

Reputational impact

Article 3

Duration and service downtime

Article 4

Geographical spread

Article 5

Data losses

Article 6

Criticality of services affected

Article 7

Economic impact

Chapter II (Articles 8 – 9)

Major incidents and materiality thresholds

Article 8

Major incidents

Article 9

Materiality thresholds for determining major incidents

Chapter III (Article 10)

Significant cyber threats

Article 10

High materiality thresholds for determining significant cyber threats

Chapter IV (Articles 11 – 12)

Relevance of major incidents to competent authorities in other Member States and details of reports to be shared with other competent authorities

Article 11

Relevance of major incidents to competent authorities in other Member States

Article 12

Details of major incidents to be shared with other competent authorities

Chapter V (Article 13)

Final provisions

Article 13

Entry into force

Article 4 Geographical spread

For the purpose of determining the geographical spread with regard to the areas affected by the incident as referred to in Article 18(1), point (c), of Regulation (EU) 2022/2554, financial entitiesas defined in Article 2, points (a) to (t) shall assess whether the incident has or had an impact in other Member States, and in particular the significance of the impact in relation to any of the following:

  1. clients and financial counterparts in other Member States;

  2. branches or other financial entitiesas defined in Article 2, points (a) to (t) within the groupa group as defined in Article 2, point (11), of Directive 2013/34/EU carrying out activities in other Member States;

  3. financial market infrastructures or third-party providers, which may affect financial entitiesas defined in Article 2, points (a) to (t) in other Member States to which they provide services, to the extent such information is available.

Table of contents