Article 18Classification of ICT-related incidents and cyber threats
1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria:
(a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact;
(b) the duration of the ICT-related incident, including the service downtime;
(c) the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States;
(d) the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data;
(e) the criticality of the services affected, including the financial entity’s transactions and operations;
(f) the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.
2. Financial entities shall classify cyber threats as significant based on the criticality of the services at risk, including the financial entity’s transactions and operations, number and/or relevance of clients or financial counterparts targeted and the geographical spread of the areas at risk.
3. The ESAs shall, through the Joint Committee and in consultation with the ECB and ENISA, develop common draft regulatory technical standards further specifying the following:
(a) the criteria set out in paragraph 1, including materiality thresholds for determining major ICT-related incidents or, as applicable, major operational or security payment-related incidents, that are subject to the reporting obligation laid down in Article 19(1);
(b) the criteria to be applied by competent authorities for the purpose of assessing the relevance of major ICT-related incidents or, as applicable, major operational or security payment-related incidents, to relevant competent authorities in other Member States’, and the details of reports of major ICT-related incidents or, as applicable, major operational or security payment-related incidents, to be shared with other competent authorities pursuant to Article 19(6) and (7);
(c) the criteria set out in paragraph 2 of this Article, including high materiality thresholds for determining significant cyber threats.
4. When developing the common draft regulatory technical standards referred to in paragraph 3 of this Article, the ESAs shall take into account the criteria set out in Article 4(2), as well as international standards, guidance and specifications developed and published by ENISA, including, where appropriate, specifications for other economic sectors. For the purposes of applying the criteria set out in Article 4(2), the ESAs shall duly consider the need for microenterprises and small and medium-sized enterprises to mobilise sufficient resources and capabilities to ensure that ICT-related incidents are managed swiftly.
The ESAs shall submit those common draft regulatory technical standards to the Commission by 17 January 2024.
Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 3 in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
DORA, the European Union regulation on digital operational resilience, Article 18
How an incident becomes “major”, and it is a classification exercise with six named criteria: the number or relevance of clients or financial counterparts affected (with transactions affected and any reputational impact where relevant); the duration, including downtime; the geographical spread, particularly if more than two Member States are affected; the data losses, as to availability, authenticity, integrity or confidentiality; the criticality of the services affected; and the economic impact, direct and indirect, in absolute and relative terms.
Cyber threats are classified as significant on the criticality of the services at risk, the number or relevance of clients or counterparts targeted, and the geographical spread of the areas at risk.
The thresholds that turn these criteria into a yes or no are not in the Regulation. Article 18 hands them to regulatory technical standards, adopted as Commission Delegated Regulation (EU) 2024/1772. An entity therefore cannot work out its reporting population from the Regulation alone; it needs that act, and should check it for amendments before relying on any figure.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-28: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items IM-01 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
DORA Documentation & Evidence ChecklistExcel
in DORA ICT Risk & Resilience Readiness
Evidence records EV-19: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Security Incident Management PolicyWord
in Security Incident Management
The regulated-entity note adds DORA's classification criteria to the policy.
Incident Classification, Severity & Escalation MatrixExcel
in Security Incident Management
The financial-entity note adds the classification criteria to the Legal and regulatory row of the classification model.
Incident Triage & First-Hour Assessment ProcedureWord
in Security Incident Management
The regulated-entity note adds the classification criteria to step F2.
Reportability Decision ModelWord
in Regulatory Incident Notification & Reporting
Criteria DC-01 to DC-08 apply the classification criteria; a section classifies significant cyber threats.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.