RTS on ICT Incident Classification & Major Incident Thresholds (Final Report)

Abstract

Final draft Regulatory Technical Standards under DORA specifying harmonised criteria and materiality thresholds for classifying ICT-related incidents, defining major incidents, recurring incidents, and significant cyber threats, and establishing consistent reporting triggers for financial entities across the EU.

Key Takeaways

• ✓
  Defines common EU-wide criteria for classifying ICT-related incidents and determining when they qualify as major incidents.
• ✓
  Introduces materiality thresholds for clients, transactions, duration, geographical spread, data loss, and economic impact.
• ✓
  Makes 'critical services affected' a mandatory condition for major incident classification.
• ✓
  Sets €100,000 economic impact threshold and quantitative client/transaction thresholds.
• ✓
  Establishes treatment of recurring incidents and criteria for identifying significant cyber threats.

Keywords