> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2025-7439-staff-costs.md). # Staff costs | | | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2025\_7439 | | **Topic** | ICT-related incidents (management / classification / reporting) | | **Legal basis** | [Article 18(4)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-iii-ict-related-incident-classification-reporting/article-18-classification-of-ict-related-incidents) DORA | | **Status** | Final Q\&A | | **Published** | 14/11/2025 | | **Submitted** | 12/05/2025 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7439) | ## Question Do imputed staff costs count as part of staff costs in accordance with [Article 18(1)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-iii-ict-related-incident-classification-reporting/article-18-classification-of-ict-related-incidents)(f) of Regulation (EU) 2022/2554 in conjunction with Article 7(1)(c) Delegated Regulation (EU) 2024/1772 and Article 4(e) Delegated Regulation (EU) 2025/301 and must, therefore, be reported as part of gross direct and indirect costs and losses of an incident? ## Background In order to determine the economic impact of an ICT-related incident, in accordance with [Article 18(1)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-iii-ict-related-incident-classification-reporting/article-18-classification-of-ict-related-incidents)(f) of Regulation (EU) 2022/2554 in conjunction with Article 7(1)(c) Delegated Regulation (EU) 2024/1772 „staff costs, including costs associated with replacement or relocation of staff, recruitment of extra staff, remuneration of overtime and recovery of lost or impaired skills” shall be taken into account. According to Article 4(e) Delegated Regulation (EU) 2025/301, these costs are to be reported as part of the final report in accordance with [Article 19(4)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-iii-ict-related-incident-classification-reporting/article-19-reporting-of-major-incidents)(c) of Regulation (EU) 2022/2554. There is no further specification, particularly with regard to imputed staff costs that do not lead directly to a monetary outflow. Article 7(2) of Delegated Regulation (EU) 2024/1772 does not provide any information on this either, according to which only „costs that are necessary for the day-to-day operation of the business” are excluded from the above-mentioned regulation. The question submitted is intended to ensure legal certainty in the interpretation of the aforementioned Delegated Regulation as well as the consistency and comparability of reports of major ICT-related incidents. In particular, it is not clear whether the staff costs to be taken into account in accordance with Article 7(1) of the Delegated Regulation also include imputed staff costs. These can arise, for example, if employees are unable to perform their line tasks due to the priority processing of an ICT-related incident or postpone them to a later date, or if they build up overtime to process an ICT-related incident, which is then reduced by way of compensatory time off. Besides these rather indirect costs the term imputed staff costs also cover (direct) costs for personnel hired and responsible for processing of ICT-related incidents. Additionally, with regard to Article 7(2) of Delegated Regulation (EU) 2024/1772, we do not find clear whether staff costs for resources which have already been earmarked and planned for incident handling fall within the day-to-day operation of the business and are hence excluded. In particular, it is unclear what is the distinction between the costs “for keeping skills of staff up to date” and those for “the recovery of lost or impaired skills”. ## Final answer Article 7 of Delegated Regulation (EU) 2024/1772 specifying the criteria for the classification of ICT-related incidents outlines the types of direct and indirect costs and losses that entities must take into account to determine the economic impact due to a ICT-related incident. Article 7(1) (c) of the Delegated Regulation (EU) 2024/1772 specifies that the economic impact of an ICT-incident includes staff costs. The provision also specifies that staff costs include costs “associated with replacement or relocation of staff, recruitment of extra staff, remuneration of overtime and recovery of lost or impaired skills”. Where the overtime is not remunerated but compensated through working time arrangements, the incident-related overtime should still count towards the staff costs, if those costs can clearly be attributed to the incident. Similarly, working time that is clearly allocated to the handling of the incident, should count towards staff costs. This consideration also applies where the resources have been earmarked or planned for incident handling in general. This ensures a consistent assessment of costs irrespective of internal processes and resource planning and allocation of financial entities. Staff training activities aimed to prevent or minimize the consequence of potential incidents fall under the exclusion of the costs in accordance with Article 7(2) of the Delegated Regulation (EU) 2024/1772 for keeping skills of staff up to date, as a cost necessary for the day-to-day operation of the business. Instead, costs for recovery of skills lost or impaired, are those which occur as a consequence of an incident in accordance with Article 7(1) of the Delegation Regulation (EU) 2024/1772, for example addressing retraining of staff that had to be reallocated. It is to be noted that the Delegation Regulation (EU) 2024/1772 does not prescribe a specific calculation methodology for these costs. This omission reflects the inherent complexity and the variability of cost structures across different financial entities and activities. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2025-7439-staff-costs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.