Classify incident

Is the incident a major ICT-related incident that must be reported to Finansinspektionen?

New incident

Questionnaire

CDR (EU) 2024/1772

An incident is major when it affects critical services and either malicious unauthorised access is identified or at least two of the criteria 3a to 3f are met (Article 8(1)). For recurring incidents (Article 8(2)), answer 3a to 3f for the incidents collectively.

Critical services and unauthorised access

1Does the incident impact critical services?
Assess if the incident:
  • affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;
  • affects or has affected financial services that require authorisation, registration or that are supervised by competent authorities; or
  • represents a successful, malicious and unauthorised access to the network and information systems of the financial entity.
Yes: Continue with question 2.
No: The incident is not a major incident and does not require reporting to competent authorities. You can stop here.
2Is unauthorised access to network and information systems identified, which may result in data losses?
Yes: If questions 1 and 2 are both answered Yes, the incident is major and must be reported under DORA. You can stop here.
No: It might still be a major incident. Answer questions 3a to 3f; if two of them are Yes, the incident is major.

Classification criteria (answer when question 2 is No)

3aClients, financial counterparts and transactions
Does the incident meet any of the following conditions?
  • the number of affected clients is higher than 10% of all clients using the affected service; or
  • the number of affected clients is higher than 100,000 clients using the affected service; or
  • the number of affected financial counterparts is higher than 30% of all financial counterparts carrying out activities related to the provision of the affected service; or
  • the number of affected transactions is higher than 10% of the daily average number of transactions carried out by the financial entity related to the affected service; or
  • the amount of affected transactions is higher than 10% of the daily average value of transactions carried out by the financial entity related to the affected service; or
  • any identified impact on clients or financial counterparts which have been identified as relevant as an outcome of the assessment made by the financial entity under Article 1(3).
Guidance

How to count (Article 1 of the classification RTS): affected clients are all natural or legal persons that are or were unable to use the service, or were otherwise adversely impacted, including third parties explicitly covered by the client contract as beneficiaries. Financial counterparts are those that have a contractual arrangement with the financial entity for the affected service. Transactions are all transactions with a monetary amount, whether fully or partially executed, where at least one part is carried out in the EU. Where actual figures cannot be determined, estimate them from comparable reference periods and mark them as estimates in the report.

3bData losses
Does the incident have any impact on the availability, authenticity, integrity or confidentiality of data, which has or will have an adverse impact on the implementation of the business objectives of the financial entity or on meeting regulatory requirements?
  • availability of data - data on demand rendered temporarily or permanently inaccessible or unusable;
  • authenticity of data - compromised trustworthiness of the source of data;
  • integrity of data - data inaccurate or incomplete due to non-authorised modification;
  • confidentiality of data - data being accessed by or disclosed to an unauthorised party or system.
3cReputational impact
Is there any reputational impact, evidenced by any of the below?
  • the incident has been reflected in the media; or
  • repetitive complaints have been received from different clients or financial counterparts on client-facing services or critical business relationships; or
  • the financial entity is unable to meet regulatory requirements; or
  • clients or financial counterparts are likely to be lost, with a material impact on the business of the financial entity.
Guidance

Take the level of visibility of the incident into account.

3dDuration and service downtime
Is the incident duration longer than 24 hours, or the service downtime longer than 2 hours for ICT services that support critical or important functions?
  • Duration is measured from the moment the incident occurs until it is resolved (estimate if not yet known). If the moment of occurrence is unknown, measure from detection. If you later learn that the incident started before it was detected, measure from the first record in network or system logs or other data sources.
  • Service downtime is measured from the moment the service is fully or partially unavailable or delayed to clients, financial counterparts or other internal or external users, until activities are restored to the level before the incident. If the downtime causes a backlog or delay after normal operations are restored, the downtime runs until that delayed service is fully provided. If the start of the downtime cannot be determined, measure from detection.
3eGeographical spread
Has the incident had a significant impact in the territories of at least two EU Member States, on:
  • clients or financial counterparts;
  • branches of the financial entity or other group financial entities; or
  • financial market infrastructures or third-party providers that may affect other financial entities?
Guidance

Cross-border relevance (Article 11 of the classification RTS): for a major incident, also assess whether it is relevant to competent authorities in other Member States - the root cause originates in another Member State, or there is a significant impact there on clients or financial counterparts, a branch or another group entity, or a financial market infrastructure or third-party provider serving other financial entities. Record the outcome in the report fields memberStatesImpactType and memberStatesImpactTypeDescription.

3fEconomic impact
Do the costs and losses incurred by the financial entity exceed, or are they likely to exceed, EUR 100,000? Estimates may be used where actual figures cannot be determined. Sum direct and indirect costs without deducting financial recoveries (insurance payouts, recovered funds etc.):
  • expropriated funds or financial assets liability, including theft;
  • replacement or relocation costs;
  • staff costs;
  • contract non-compliance fees;
  • customer redress and compensation costs;
  • forgone revenues;
  • communication costs;
  • advisory costs.
Guidance

Do not include costs necessary for the day-to-day operation of the business (general maintenance of infrastructure, equipment, hardware and software, and keeping staff skills up to date), internal or external costs to enhance the business after the incident (upgrades, improvements, risk-assessment initiatives) or insurance premiums. Convert amounts in other currencies to EUR before comparing with the threshold.

Result

Answer the questions to see the result.

The moment of classification starts the 4-hour clock for the initial notification (CDR (EU) 2025/301 Article 5). Defaults to now when the incident is first classified as major.

Select an incident above to save the result. Without an incident the answers are kept only on this page.