Beta

Source: OJ L, 2025/301, 20.2.2025

EN

RTS on incident reporting

Commission Delegated Regulation (EU) 2025/301

of 23 October 2024

supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council

with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions; for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011(1)OJ L 333, 27.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj., and in particular Article 20, third subparagraph thereof,

Whereas:

Open full page
Recital 1 Reporting time limits

To ensure the harmonisation and simplication of the notification and reporting requirements for major ICT-related incidents means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; referred to in Article 19(4) of Regulation (EU) 2022/2554, the time limits for reporting major ICT-related incidents means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; should follow a consistent approach for all types of financial entitiesas defined in Article 2, points (a) to (t). For these reasons, the time limits should also, to the greatest extent possible, follow a consistent approach with, and at least be equivalent in effect to, the requirements set out in Directive (EU) 2022/2555 of the European Parliament and of the Council(2)Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80, ELI: http://data.europa.eu/eli/dir/2022/2555/oj)..

Recital 2 Time limit for the initial notification

To avoid imposing an undue reporting burden on financial entitiesas defined in Article 2, points (a) to (t) at a time when they are handling the ICT-related incident means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity;, the content of the initial notification should be limited to the most significant information. To be able to take proper supervisory action, competent authoritiesas defined in Article 46 need to receive information about major ICT-related incidents means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; as quickly as possible after the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; has classified an ICT-related incident means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity; as major. Consequently, the time limit for submitting an initial notification as referred to in Article 19(4), point (a), of Regulation (EU) 2022/2554 should be as short as possible after an ICT-related incident means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity; has been classified as major, whilst still allowing for flexibility, especially for service business models that are not particularly time-critical, in case financial entitiesas defined in Article 2, points (a) to (t) need more time to handle the ICT-related incident means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity; after becoming aware of it.

Recital 3 The intermediate and final reports

After having received the initial notification, competent authoritiesas defined in Article 46 should receive more detailed information about the ICT-related incident means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity; in the intermediate report and all relevant information in the final report. The information in those reports should enable competent authoritiesas defined in Article 46 to further assess the ICT-related incident means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity; and evaluate supervisory actions they may want to take.

HAS ADOPTED THIS REGULATION:

  1. Article 1General information to be provided in initial notifications and intermediate and final reports on major ICT-related incidents
  2. Article 2Specific information to be provided in initial notifications
  3. Article 3Specific information to be provided in intermediate reports
  4. Article 4Article Specific information to be provided in final reports
  5. Article 5Time limits for the initial notification, and for the intermediate and final reports
  6. Article 6Content of the voluntary notification of significant cyber threats
  7. Article 7Entry into force

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 23 October 2024.

For the Commission

The President

Ursula VON DER LEYEN

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Contact us:

dora@springflod.se

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod