> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7050-duplicate-ict-incident-reporting.md). # Duplicate ICT Incident Reporting | | | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2024\_7050 | | **Topic** | ICT-related incidents (management / classification / reporting) | | **Legal basis** | [Article 19](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-iii-ict-related-incident-classification-reporting/article-19-reporting-of-major-incidents) DORA | | **Status** | Final Q\&A | | **Published** | 11/12/2024 | | **Submitted** | 03/04/2024 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7050) | ## Question Is duplicate incident reporting via the ECB SSM Cyber Incident Reporting Framework required, alongside DORA incident reporting under Article 19? ## Background Significant credit institutions are required to notify the ECB of significant cyber incidents via their own SSM portal. These reports will duplicate reporting due under DORA, where the ECB is the competent authority. ## Final answer Recital 51 of Regulation (EU) 2022/2554 clarifies that ICT-related incident reporting should be harmonised through the introduction of a requirement for all financial entities to report directly to their relevant competent authorities. Where a financial entity is subject to supervision by more than one national competent authority, Member States should designate a single competent authority as the addressee of such reporting. Credit institutions classified as significant in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should submit such reporting to the national competent authorities, which should subsequently transmit the report to the European Central Bank (ECB). Accordingly, ICT-related major incidents, including cyberincidents, affecting significant institutions in accordance with [Article 6(4)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-ii-ict-risk-management/article-6-ict-risk-management-framework) of Council Regulation (EU) No 1024/2013 (19) should be classified and reported only under regulation (EU)2022/2554 and the related Technical Standards. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7050-duplicate-ict-incident-reporting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.