📋 Incident Analysis

1
Incident Identification
2
Critical Services Affected (the Gate)

ICT services or systems that support a critical or important function, or a financial service that requires authorisation or registration, or is supervised by a competent authority.

An access of this kind affects critical services on its own. If it may result in data losses, the incident is major without any other threshold.

3
Materiality Thresholds (RTS Art. 9)

More than 10% of the clients using the affected service, or more than 100,000 of them; more than 30% of its financial counterparts; more than 10% of its daily average transactions by number or value; or a client or counterpart identified as relevant.

Duration runs from the occurrence of the incident to its resolution; downtime from the moment the service is fully or partially unavailable until it is restored.

Clients or counterparts, branches or group entities, or market infrastructures and third-party providers affected in other Member States.

Media coverage, repetitive complaints from different clients or counterparts, regulatory requirements likely to be missed, or clients or counterparts likely to be lost with a material impact.

An impact on the availability, authenticity, integrity or confidentiality of data that harms your business objectives or your ability to meet regulatory requirements.

Direct and indirect costs and losses of Art. 7, counted before financial recoveries.

Note: The classification follows Article 8(1) of Delegated Regulation (EU) 2024/1772: critical services affected, and either a malicious access that may result in data losses or two or more other thresholds. This analysis is indicative and must be validated by your incident management officer.
⚠️
Minor Incident
Complete the form to obtain the classification

DORA Criteria Assessed