Critical Services Affected

Article 6 of Commission Delegated Regulation (EU) 2024/1772 provides that ‘financial entities shall assess whether the incident: (a) affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity; (b) Affects or has affected financial services provided by the financial entity that require authorisation, registration or that are supervised by competent authorities; (c) constitutes or has constituted a successful, malicious and unauthorized access to the network and information systems of the financial entity.’ In accordance with Article 8 of the Commission Delegated Regulation, an incident shall be considered major, and therefore be reported to the national competent authority, when it has affected critical services under Article 6 and when the additional specific conditions in Article 8 are met. Accordingly, for the purpose of classification of major ICT incidents under the Delegated Regulation and Article 19(1) of Regulation (EU) 2022/2554, an impact on any of the components listed in Article 6 of the Delegated Regulation should be considered as affecting critical services.