--- title: "Article 18 — Classification of ICT-related incidents and cyber threats" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 18 — Classification of ICT-related incidents and cyber threats" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 18 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. Financial entities shall classify [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) and shall determine their impact based on the following criteria: **(a)** the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident), and whether the [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) has caused reputational impact; **(b)** the duration of the [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident), including the service downtime; **(c)** the geographical spread with regard to the areas affected by the [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident), particularly if it affects more than two Member States; **(d)** the data losses that the [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) entails, in relation to availability, authenticity, integrity or confidentiality of data; **(e)** the criticality of the services affected, including the financial entity’s transactions and operations; **(f)** the economic impact, in particular direct and indirect costs and losses, of the [ICT-related incident](https://www.headlesslaw.com/definitions/dora/ict-related-incident) in both absolute and relative terms. 2. Financial entities shall classify [cyber threats](https://www.headlesslaw.com/definitions/dora/cyber-threat) as significant based on the criticality of the services at risk, including the financial entity’s transactions and operations, number and/or relevance of clients or financial counterparts targeted and the geographical spread of the areas at risk. 3. The ESAs shall, through the [Joint Committee](https://www.headlesslaw.com/definitions/dora/joint-committee) and in consultation with the ECB and ENISA, develop common draft regulatory technical standards further specifying the following: **(a)** the criteria set out in paragraph 1, including materiality thresholds for determining [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) or, as applicable, [major operational or security payment-related incidents](https://www.headlesslaw.com/definitions/dora/major-operational-or-security-payment-related-incident), that are subject to the reporting obligation laid down in [Article 19(1)](19.md); **(b)** the criteria to be applied by competent authorities for the purpose of assessing the relevance of [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) or, as applicable, [major operational or security payment-related incidents](https://www.headlesslaw.com/definitions/dora/major-operational-or-security-payment-related-incident), to relevant competent authorities in other Member States’, and the details of reports of [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) or, as applicable, [major operational or security payment-related incidents](https://www.headlesslaw.com/definitions/dora/major-operational-or-security-payment-related-incident), to be shared with other competent authorities pursuant to [Article 19(6)](19.md) and (7); **(c)** the criteria set out in paragraph 2 of this Article, including high materiality thresholds for determining [significant cyber threats](https://www.headlesslaw.com/definitions/dora/significant-cyber-threat). 4. When developing the common draft regulatory technical standards referred to in paragraph 3 of this Article, the ESAs shall take into account the criteria set out in [Article 4(2)](4.md), as well as international standards, guidance and specifications developed and published by ENISA, including, where appropriate, specifications for other economic sectors. For the purposes of applying the criteria set out in [Article 4(2)](4.md), the ESAs shall duly consider the need for [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise) and small and medium-sized enterprises to mobilise sufficient resources and capabilities to ensure that [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) are managed swiftly. The ESAs shall submit those common draft regulatory technical standards to the Commission by 17 January 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 3 in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010. ## Related Level 2 and Level 3 ### Binding measures - [2024/1772 — RTS — ICT Incident Classification \[in force\]](../level-2/rts/2024-1772-ict-incident-classification.md) ### Guidance and Q&A - [EBA Q&A 2024_7047 — Q&A — Critical Services Affected \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2024-7047-critical-services-affected.md) - [EBA Q&A 2025_7439 — Q&A — Staff costs \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2025-7439-staff-costs.md) - [EBA Q&A 2026_7779 — Q&A — Scope of Article 6 lit. c RTS \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2026-7779-scope-of-article-6-lit-c-rts.md) *** [Chapter III — ICT-related incident management, classification and reporting](../chapters/iii.md) · [← Article 17](17.md) · [Article 19 →](19.md)