Final report

Due within one month of the latest intermediate report.

Incident

The form is pre-filled from the intermediate report, your settings and the incident. Your draft is saved automatically in this browser. Required fields are marked *; the server checks the report against the ESA JSON schema when you validate or download.

Report header

Schema reference

schemaRef

Reporting date *

YYYY-MM-DD. reportingDate

Financial entity ID *

The identifier of the reporting entity at the competent authority (for Finansinspektionen: the institution number). financialEntityId

Resubmission

Yes when correcting a report that has already been submitted. resubmission

Type of submission

1 fields

Type of submission *

Choose "major incident reclassified as non-major" to withdraw an incident that turned out not to be major. incidentSubmission · 010 - 010

Entity and contacts

16 fields

Name of the entity submitting the report *

submittingEntity-name · 010 - 010

Identification code of the entity submitting the report (LEI)

20 characters: 18 letters or digits followed by 2 check digits. Use either the LEI or the entity code, not both. submittingEntity-LEI · 010 - 020

Identification code of the entity submitting the report (EU ID)

Only when the submitting entity has no LEI. submittingEntity-code · 010 - 030

Type of the affected financial entity

Credit institution Payment institution Exempted payment institution Account information service provider Electronic money institution Exempted electronic money institution Investment firm Crypto-asset service provider Issuer of asset-referenced tokens Central securities depository Central counterparty Trading venue Trade repository Manager of alternative investment fund Management company Data reporting service provider Insurance and reinsurance undertaking Insurance intermediary reinsurance intermediary and ancillary insurance intermediary Institution for occupational retirement provision Credit rating agency Administrator of critical benchmarks Crowdfunding service provider Securitisation repository

affectedEntityType · 010 - 040

Name of the financial entity affected

affectedEntity-name · 010 - 050

LEI code of the financial entity affected

Only when the affected entity differs from the submitting entity. affectedEntity-LEI · 010 - 060

Primary contact person name *

primaryContact-name · 010 - 070

Primary contact person email *

primaryContact-email · 010 - 080

Primary contact person telephone *

International format, for example +46 8 123 456 78. primaryContact-phone · 010 - 090

Second contact person name *

secondaryContact-name · 010 - 100

Second contact person email *

secondaryContact-email · 010 - 110

Second contact person telephone *

International format, for example +46 8 123 456 78. secondaryContact-phone · 010 - 120

Name of the ultimate parent undertaking

ultimateParentUndertaking-name · 010 - 130

LEI code of the ultimate parent undertaking

Leave empty when the parent is the submitting entity itself. ultimateParentUndertaking-LEI · 010 - 140

Reporting currency *

reportCurrency · 010 - 150

Incident reference code provided by the competent authority *

Incident reference code assigned by the competent authority after the initial notification (starts with CAFIX). competentAuthorityCode · 010 - 010

Incident (initial notification)

10 fields

Incident reference code assigned by the financial entity *

Your own unique reference code for the incident. Use the same code in all three reports. financialEntityCode · 010 - 160

Date and time of detection of the ICT-related incident *

When the financial entity became aware of the incident. Swedish time; exported in UTC. detectionDateTime · 010 - 170

Date and time of classification of the incident as major *

When the incident was classified as major. Swedish time; exported in UTC. classificationDateTime · 010 - 180

Description of the ICT-related incident *

incidentDescription · 010 - 190

Classification criteria that triggered the incident report *

Clients financial counterparts and transactions affected Geographical spread Data losses Economic impact Reputational impact Duration and service downtime Critical services affected

classificationCriterion · 010 - 200

Materiality thresholds for the classification criterion ‘Geographical spread’

AT BE BG CY CZ DE DK EE ES FI FR GR HR HU IE IS IT LI LT LU LV MT NL NO PL PT RO SE SI SK

Only used when geographical spread is a selected criterion. The home Member State is removed automatically. countryCodeMaterialityThresholds · 010 - 210

Discovery of the major ICT-related incident *

incidentDiscovery · 010 - 220

Indication whether the incident originates from a third party provider or another financial entity

originatesFromThirdPartyProvider · 010 - 230

Activation of business continuity plan, if activated

isBusinessContinuityActivated · 010 - 240

Other relevant information

otherInformation · 010 - 250

Impact and handling (intermediate report)

34 fields

Date and time of occurrence of the incident *

When the incident occurred. Swedish time; exported in UTC. incidentOccurrenceDateTime · 010 - 020

Date and time when services, activities or operations have been recovered

When regular activities or operations were restored. Swedish time; exported in UTC. serviceRestorationDateTime · 010 - 030

Number of clients affected *

numberOfAffectedClients · 010 - 040

Percentage of clients affected *

0-100 with at most one decimal. percentageOfAffectedClients · 010 - 050

Number of financial counterparts affected *

numberOfAffectedFinancialCounterparts · 010 - 060

Percentage of financial counterparts affected *

0-100 with at most one decimal. percentageOfAffectedFinancialCounterparts · 010 - 070

Impact on relevant clients or financial counterparts

hasImpactOnRelevantClients · 010 - 080

Number of affected transactions

numberOfAffectedTransactions · 010 - 090

Percentage of affected transactions

0-100 with at most one decimal. percentageOfAffectedTransactions · 010 - 100

Value of affected transactions

In the report currency, at most one decimal. valueOfAffectedTransactions · 010 - 110

Information on whether the numbers are actual or estimates, or whether there has not been any impact *

Actual figures for clients affected Actual figures for financial counterparts affected Actual figures for transactions affected Estimates for clients affected Estimates for financial counterparts affected Estimates for transactions affected No impact on clients No impact on financial counterparts No impact on transactions

numbersActualEstimate · 010 - 120

Reputational impact

The major ICT-related incident has been reflected in the media The major ICT-related incident has resulted in repetitive complaints from different clients or financial counterparts on client-facing services or critical business relationships The financial entity will not be able to or is likely not to be able to meet regulatory requirements as a result of the major ICT-related incident The financial entity will or is likely to lose clients or financial counterparts with a material impact on its business as a result of the major ICT-related incident

reputationalImpactType · 010 - 130

Contextual information about the reputational impact

reputationalImpactDescription · 010 - 140

Duration of the major ICT-related incident *

Days, hours and minutes as DD:HH:MM, for example 01:04:30. incidentDuration · 010 - 150

Service downtime

Days, hours and minutes as DD:HH:MM, for example 00:02:15. serviceDowntime · 010 - 160

Information whether the numbers for duration and service downtime are actual or estimates.

informationDurationServiceDowntimeActualOrEstimate · 010 - 170

Types of impact in the Member States

Clients Financial counterparts Branch of the financial entity Financial entities within the group carrying out activities in the respective member state Financial market infrastructure Third-party providers that may be common to other financial entities

memberStatesImpactType · 010 - 180

Description of how the major ICT-related incident has an impact in other Member States

memberStatesImpactTypeDescription · 010 - 190

Materiality thresholds for the classification criterion ‘Data losses’

Availability Authenticity Integrity Confidentiality

materialityThresholdsDataLosses · 010 - 200

Description of the data losses

dataLossesDescription · 010 - 210

Classification criterion ‘Critical services affected’ *

criticalServicesAffected · 010 - 220

Type of the major ICT-related incident *

Cybersecurity-related Process failure System failure External event Payment-related Other

incidentClassification · 010 - 230

Other types of incidents

otherIncidentClassification · 010 - 240

Threats and techniques used by the threat actor

Social engineering including phishing DDoS Identity theft Data encryption for impact including ransomware Resource hijacking Data exfiltration and manipulation including identity theft Data destruction Defacement Supply-chain attack Other

threatTechniques · 010 - 250

Other types of techniques

otherThreatTechniques · 010 - 260

Information about affected functional areas and business processes *

affectedFunctionalAreas · 010 - 270

Affected infrastructure components supporting business processes *

isAffectedInfrastructureComponents · 010 - 280

Information about affected infrastructure components supporting business processes

affectedInfrastructureComponents · 010 - 290

Impact on the financial interest of clients *

isImpactOnFinancialInterest · 010 - 300

Reporting to other authorities *

Police law enforcement CSIRT Data protection authority National cybersecurity agency None Other

reportingToOtherAuthorities · 010 - 310

Specification of ‘other’ authorities

reportingToOtherAuthoritiesOther · 010 - 320

Temporary actions/measures taken or planned to be taken to recover from the incident *

isTemporaryActionsMeasuresForRecovery · 010 - 330

Description of any temporary actions and measures taken or planned to be taken to recover from the incident

descriptionOfTemporaryActionsMeasuresForRecovery · 010 - 340

Indicators of compromise

indicatorsOfCompromise · 010 - 350

Root cause and resolution (final report)

16 fields

High-level classification of root causes of the incident *

Malicious actions Process failure System failure malfunction Human error External event

rootCauseHLClassification · 010 - 010

Detailed classification of root causes of the incident *

Malicious actions deliberate internal actions Malicious actions deliberate physical damage manipulation theft Malicious actions fraudulent actions Process failure insufficient monitoring or failure of monitoring and control Process failure insufficient unclear roles and responsibilities Process failure ICT risk management process failure Process failure insufficient or failure of ICT operations and ICT security operations Process failure insufficient or failure of ICT project management Process failure inadequacy of internal policies procedures and documentation Process failure inadequate ICT systems acquisition development and maintenance Process failure other System failure hardware capacity and performance System failure hardware maintenance System failure hardware obsolescence ageing System failure software compatibility configuration System failure software performance System failure network configuration System failure physical damage System failure other Human error omission Human error mistake Human error skills knowledge Human error inadequate human resources Human error miscommunication Human error other External event natural disasters force majeure External event third-party failures External event other

rootCausesDetailedClassification · 010 - 020

Additional classification of root causes of the incident *

Monitoring of policy adherence Monitoring of third-party service providers Monitoring and verification of remediation of vulnerabilities Identity and access management Encryption and cryptography Logging Failure in specifying accurate risk tolerance levels Insufficient vulnerability and threat assessments Inadequate risk treatment measures Poor management of residual ICT risks Vulnerability and patch management Change management Capacity and performance management ICT asset management and information classification Backup and restore Error handling Inadequate ICT systems acquisition development and maintenance Insufficient or failure of software testing

rootCausesAdditionalClassification · 010 - 030

Other types of root cause types

rootCausesOther · 010 - 040

Information about the root causes of the incident *

rootCausesInformation · 010 - 050

Incident resolution *

incidentResolutionSummary · 010 - 060

Date and time when the incident root cause was addressed *

When the root cause was addressed. Swedish time; exported in UTC. rootCauseAddressingDateTime · 010 - 070

Date and time when the incident was resolved *

When the incident was resolved. Swedish time; exported in UTC. incidentResolutionDateTime · 010 - 080

Information if the permanent resolution date of the incidents differs from the initially planned implementation date *

incidentResolutionVsPlannedImplementation · 010 - 090

Assessment of risk to critical functions for resolution purposes

assessmentOfRiskToCriticalFunctions · 010 - 100

Information relevant for resolution authorities

informationRelevantToResolutionAuthorities · 010 - 110

Materiality threshold for the classification criterion ‘Economic impact’ *

materialityThresholdsEconomicImpact · 010 - 120

Amount of gross direct and indirect costs and losses *

In the report currency, at most one decimal. grossAmountIndirectDirectCosts · 010 - 130

Amount of financial recoveries *

In the report currency, at most one decimal. financialRecoveriesAmount · 010 - 140

Information on whether the non-major incidents have been recurring

recurringNonMajorIncidentsDescription · 010 - 150

Date and time of occurrence of recurring incidents

recurringIncidentDate · 010 - 160

Generated report

Upload the file in Finansinspektionen's reporting portal. When it has been submitted, record the submission time so the next deadline can be calculated.

Show JSON