In this act Article 6 of 7

Article 6 — Content of the voluntary notification of significant cyber threats

Financial servicesLevel 2RTSDORAIn forceOfficial source

The content of the voluntary notification in relation to significant cyber threats as referred to in Article 19(2) of Regulation (EU) 2022/2554 shall cover all of the following:

6(a)

a)general information about the notifying financial entity as set out in Article 1;

Copy link

6(b)

b)the date and time of detection of the significant cyber threat and any other relevant timestamps related to the significant cyber threat;

Copy link

6(c)

c)a description of the significant cyber threat;

Copy link

6(d)

d)information about the potential impact of the significant cyber threat on the financial entity, its clients, or financial counterparts;

Copy link

6(e)

e)the classification criteria that would have triggered a major incident report laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772 if the cyber threat had materialised;

Copy link

6(f)

f)information about the status of the significant cyber threat and any changes in the threat activity;

Copy link

6(g)

g)where applicable, a description of the actions taken by the financial entity to prevent the materialisation of the significant cyber threats;

Copy link

6(h)

h)information about any notification of the significant cyber threat to other financial entities or authorities;

Copy link

6(i)

i)where applicable, information on indicators of compromise;