DORA RTS on Incident Classification

For the purposes of Article 18(2) of Regulation (EU) 2022/2554, a cyber threat shall be considered significant where all of the following conditions are fulfilled:

1. (a)
   the cyber threat, if materialised, could affect or could have affected critical or important functions of the financial entity, or could affect other financial entities, third-party providers, clients or financial counterparts, based on information available to the financial entity;
2. (b)
   the cyber threat has a high probability of materialisation at the financial entity or at other financial entities, taking into account at least the following elements:

   1. (i)
      applicable risks related to the cyber threat referred to in point (a), including potential vulnerabilities of the systems of the financial entity that can be exploited;
   2. (ii)
      the capabilities and intent of threat actors to the extent known by the financial entity;
   3. (iii)
      the persistence of the threat and any accrued knowledge about incidents that have impacted the financial entity or its third-party provider, clients or financial counterparts;

3. (c)
   the cyber threat could, if materialised, meet any of the following:

   1. (i)
      the criterion regarding criticality of services set out in Article 18(1), point (e), of Regulation (EU) 2022/2554, as specified in Article 6 of this Regulation;
   2. (ii)
      the materiality threshold set out in Article 9(1);
   3. (iii)
      the materiality threshold set out in Article 9(4).