Duplicate ICT Incident Reporting

EBA Q&A 2024_7050 on Regulation (EU) 2022/2554 (DORA): Duplicate ICT Incident Reporting.

Authority	EBA
Q&A ID	EBA_QA_2024_7050
Topic	ICT-related incidents (management / classification / reporting)
Legal basis	Article 19 DORA
Status	Final Q&A
Published	11/12/2024
Submitted	03/04/2024
Answer prepared by	Answer prepared by the Joint ESAs Q&A
Source	EBA Q&A

Question

Is duplicate incident reporting via the ECB SSM Cyber Incident Reporting Framework required, alongside DORA incident reporting under Article 19?

Background

Significant credit institutions are required to notify the ECB of significant cyber incidents via their own SSM portal. These reports will duplicate reporting due under DORA, where the ECB is the competent authority.

Final answer

Recital 51 of Regulation (EU) 2022/2554 clarifies that ICT-related incident reporting should be harmonised through the introduction of a requirement for all financial entities to report directly to their relevant competent authorities. Where a financial entity is subject to supervision by more than one national competent authority, Member States should designate a single competent authority as the addressee of such reporting. Credit institutions classified as significant in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should submit such reporting to the national competent authorities, which should subsequently transmit the report to the European Central Bank (ECB).

Accordingly, ICT-related major incidents, including cyberincidents, affecting significant institutions in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should be classified and reported only under regulation (EU)2022/2554 and the related Technical Standards.