Help: Classification

Classification

An ICT-related incident is major when it affects critical services and either malicious unauthorised access to network and information systems is identified, or at least two of the six criteria below are met (CDR (EU) 2024/1772 Article 8(1)).

The questions

  1. Critical services – does the incident affect ICT services or systems that support critical or important functions, financial services that require authorisation or registration, or is it a successful, malicious and unauthorised access? If not, the incident is not major.
  2. Unauthorised access – is unauthorised access identified that may result in data losses? When 1 and 2 are both Yes, the incident is major.
  3. Criteria – when question 2 is No, answer 3a to 3f. Two or more Yes answers make the incident major.
    • 3a Clients, financial counterparts and transactions (Article 1)
    • 3b Data losses (Article 5)
    • 3c Reputational impact (Article 2)
    • 3d Duration and service downtime (Article 3)
    • 3e Geographical spread – two or more Member States (Article 4)
    • 3f Economic impact – costs and losses above EUR 100 000 (Article 7)

Each question in the app includes the RTS guidance on how to count clients, measure duration and downtime, and which costs to include.

Saving the result

Select an incident at the top of the questionnaire and press Save to incident. The answers, the result and the criteria that were met are stored with the incident and pre-fill the classification criteria in the reports.

When the incident is classified as major, set Classified as major at. This is the moment of classification under CDR (EU) 2025/301 Article 5 and starts the 4-hour clock for the initial notification.

Recurring incidents

Incidents that individually are not major count as one major incident when they have occurred at least twice within six months, have the same apparent root cause and collectively meet the criteria (CDR (EU) 2024/1772 Article 8(2)). Answer questions 3a to 3f for the incidents collectively, and list the recurring incidents in the final report.

Reclassification

If a major incident is later found not to be major, report this with the initial notification form by choosing Major incident reclassified as non-major as the type of submission.