In this act Article 10 of 13
Article 10 — High materiality thresholds for determining significant cyber threats
Financial servicesLevel 2RTSDORAIn forceOfficial source
For the purposes of Article 18(2) of Regulation (EU) 2022/2554, a cyber threat shall be considered significant where all of the following conditions are fulfilled:
10(a)
a)the cyber threat, if materialised, could affect or could have affected critical or important functions of the financial entity, or could affect other financial entities, third-party providers, clients or financial counterparts, based on information available to the financial entity;
Copy link10(b)
b)the cyber threat has a high probability of materialisation at the financial entity or at other financial entities, taking into account at least the following elements:
Copy link10(b)(i)
i)applicable risks related to the cyber threat referred to in point (a), including potential vulnerabilities of the systems of the financial entity that can be exploited;
Copy link10(b)(ii)
ii)the capabilities and intent of threat actors to the extent known by the financial entity;
Copy link10(b)(iii)
iii)the persistence of the threat and any accrued knowledge about incidents that have impacted the financial entity or its third-party provider, clients or financial counterparts;
Copy link10(c)(i)
i)the criterion regarding criticality of services set out in Article 18(1), point (e), of Regulation (EU) 2022/2554, as specified in Article 6 of this Regulation;
Copy linkWhere, depending on the type of cyber threat and available information, the financial entity concludes that the materiality thresholds set out in Article 9(2), (3), (5) and (6) could be met, those thresholds may also be considered.
CHAPTER IV
RELEVANCE OF MAJOR INCIDENTS TO COMPETENT AUTHORITIES IN OTHER MEMBER STATES AND DETAILS OF REPORTS TO BE SHARED WITH OTHER COMPETENT AUTHORITIES