Major incident reporting

Preamble (Recitals 1 – 8)

Recitals

Article 1

General provisions

Article 2

General information to be provided in the major incident initial notification, intermediate and final reports

Article 3

Content of initial notifications

Article 4

Content of intermediate reports

Article 5

Content of final reports

Article 6

Time limits for the initial notification and intermediate report and final reports referred to in Article 19(4) of Regulation (EU)2022/2554

Article 7

Content of the voluntary notification of significant cyber threat

Article 8

Entry into force

Article 5Note: This article is based on the final draft from the ESAs and is not yet adopted. Content of final reports

Financial entitiesas defined in Article 2, points (a) to (t) shall provide the following information about the incident in the final report:

  1. information about the root causes of the incident;

  2. dates and times when the incident was resolved and the root cause addressed;

  3. information on the incident resolution;

  4. information relevant for resolution authorities, where applicable;

  5. information about direct and indirect costs and losses stemming from the incident and information about financial recoveries; and

  6. information about recurring incidents, where applicable.

Table of contents