Info
🔗 Back to Summary. 🇫🇷 French Version: 2024R1772_FR.10. Back to Summary of LVL1. Open the PDF. Direct link to EUR-LEX.
Article 9 – Materiality thresholds for determining major incidents ⬅️ | ➡️ Article 11 – Relevance of major incidents to competent authorities in other Member States
Références LVL1 <=> LVL2
Level 1 reference(s): 2022R2554_EN.18 > 2
Article 10 - High materiality thresholds for determining significant cyber threats
For the purposes of 2022, a cyber threat shall be considered significant where all of the following conditions are fulfilled:
(a)
the cyber threat, if materialised, could affect or could have affected critical or important functions of the financial entity, or could affect other financial entities, third-party providers, clients or financial counterparts, based on information available to the financial entity;
(b)
the cyber threat has a high probability of materialisation at the financial entity or at other financial entities, taking into account at least the following elements:
(i)
applicable risks related to the cyber threat referred to in point (a), including potential vulnerabilities of the systems of the financial entity that can be exploited;
(ii)
the capabilities and intent of threat actors to the extent known by the financial entity;
(iii)
the persistence of the threat and any accrued knowledge about incidents that have impacted the financial entity or its third-party provider, clients or financial counterparts;
(c)
the cyber threat could, if materialised, meet any of the following:
(i)
the criterion regarding criticality of services set out in Article 18(1), point (e), of Regulation (EU) 2022/2554, as specified in Article 6 of this Regulation;
(ii)
the materiality threshold set out in Article 9(1);
(iii)
the materiality threshold set out in Article 9(4).
Where, depending on the type of cyber threat and available information, the financial entity concludes that the materiality thresholds set out in Article 9(2), (3), (5) and (6) could be met, those thresholds may also be considered.