Major incident reporting

Preamble (Recitals 1 – 8)

Recitals

Article 1

General provisions

Article 2

General information to be provided in the major incident initial notification, intermediate and final reports

Article 3

Content of initial notifications

Article 4

Content of intermediate reports

Article 5

Content of final reports

Article 6

Time limits for the initial notification and intermediate report and final reports referred to in Article 19(4) of Regulation (EU)2022/2554

Article 7

Content of the voluntary notification of significant cyber threat

Article 8

Entry into force

Article 3Note: This article is based on the final draft from the ESAs and is not yet adopted. Content of initial notifications

Financial entitiesas defined in Article 2, points (a) to (t) shall provide at least the following information about the incident in the initial notification:

  1. incident reference code;

  2. date and time of detection and classification of the incident;

  3. description of the incident;

  4. classification criteria that triggered the incident report as set out in [Articles 1 to 8 of Delegated Regulation [insert number once published in official journal]Official text not yet finalized.;

  5. members States impacted by the incident, where applicable;

  6. information on how the incident has been discovered;

  7. information about the origin of the incident, where available;

  8. indication whether a business continuity plan has been activated;

  9. information about the reclassification of the incident from major to non-major, where applicable; and

  10. other information, where available.

Table of contents