DORA RTS on Incident Reporting Template

Identification code of the entity submitting the notification.

Where financial entities submit the notification/report, the identification code shall be a Legal Entity Identifier (LEI), which is a unique 20 alphanumeric character code, based on ISO 17442-1:2020.

Where a third-party provider submits a report for a financial entity, it may use an identification code as specified in the implementing technical standards adopted pursuant to Article 28(9) of Regulation (EU) 2022/2554.

Choice (multiselect):

• credit institution;

• payment institution;

• exempted payment institution;

• account information service provider;

• electronic money institution;

• exempted electronic money institution;

• investment firm;

• crypto-asset service provider;

• issuer of asset-referenced tokens;

• central securities depository;

• central counterparty;

• trading venue;

• trade repository;

• manager of alternative investment fund;

• management company;

• data reporting service provider;

• insurance and reinsurance undertaking;

• insurance intermediary, reinsurance intermediary and ancillary insurance intermediary;

• institution for occupational retirement provision;

• credit rating agency;

• administrator of critical benchmarks;

• crowdfunding service provider;

• securitisation repository.

The telephone number of the primary contact person that can be used by the competent authority for follow-up communication.

The telephone number shall be reported with all international prefixes (e.g. +33XXXXXXXXX)

The telephone number of the second contact person that can be used by the competent authority for follow-up communication, where available.

The telephone number shall be reported with all international prefixes (e.g. +33XXXXXXXXX).

Description of the most relevant aspects of the significant cyber threat.

Financial entities shall provide:

1. (a)
   a high-level overview of the most relevant aspects of the significant cyber threat;
2. (b)
   the related risks arising from it, including potential vulnerabilities of the systems of the financial entity that can be exploited;
3. (c)
   information about the probability of materialisation of the significant cyber threat; and
4. (d)
   information about the source of information about the cyber threat.

Choice (multiple):

• clients, financial counterparts and transactions affected;

• reputational impact;

• duration and service downtime;

• geographical spread;

• data losses;

• critical services affected;

• economic impact.

Information about the status of the cyber threat for the financial entity and whether there have been any changes in the threat activity.

Where the cyber threat has stopped communicating with the financial entity’s information systems, the status can be marked as inactive. If the financial entity has information that the threat remains active against other parties or the financial system as a whole, the status shall be marked as active.

Choice:

• active;

• inactive.

Information related to the significant threat that may help identify malicious activity within a network or information system (Indicators of Compromise, or IoC), where applicable.

The IoC provided by the financial entity may include, but is not to be limited to, the following categories of data:

1. (a)
   IP addresses;
2. (b)
   URL addresses;
3. (c)
   domains;
4. (d)
   file hashes;
5. (e)
   malware data (malware name, file names and their locations, specific registry keys associated with malware activity);
6. (f)
   network activity data (ports, protocols, addresses, referrers, user agents, headers, specific logs or distinctive patterns in network traffic);
7. (g)
   email message data (sender, recipient, subject, header, content);
8. (h)
   DNS requests and registry configurations;
9. (i)
   user account activities (logins, privileged user account activity, privilege escalation);
10. (j)
    database traffic (read/write), requests to the same file.

This type of information may include data relating to indicators describing patterns in network traffic corresponding to known attacks/botnet communications, IP addresses of machines infected with malware (bots), data relating to ‘command and control’ servers used by malware (usually domains or IP addresses), and URLs relating to phishing sites or websites observed hosting malware or exploit kits.