--- title: "EBA Q&A 2026_7779 — Q&A — Scope of Article 6 lit. c RTS [Final Q&A]" shortTitle: "EBA Q&A 2026_7779 — Q&A — Scope of Article 6 lit. c RTS [Final Q&A]" answer_id: EBA_QA_2026_7779 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "DORA" dora_level3: true mica_level2: false legal_basis: "Article 18(1) DORA" date: 2 October 2026 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2026_7779 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 2 October 2026" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2026_7779" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "Joint ESAs" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the Joint ESAs Q&A" locator: "EBA Q&A register entry 2026_7779, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2026-10-02" question_submitted_on: "2026-03-18" locators: published_on: "EBA Q&A register entry 2026_7779, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2026_7779, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer prepared by the Joint ESAs, published in the EBA Q&A tool · not legislation · published 2 Oct 2026 [Final Q&A]** *Final Q&A · EBA Q&A register, 2 October 2026 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2026_7779)* | | | |---|---| | **Full title** | EBA Q&A 2026_7779 — Q&A — Scope of Article 6 lit. c RTS \[Final Q&A\] | | **Prepared by** | Joint ESAs | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2026_7779 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 2 October 2026; question submitted 18 March 2026 | | **Legal basis** | [Article 18(1)](https://www.headlesslaw.com/dora/articles/18) DORA | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Scope of Article 6 lit. c RTS** ### Question Is the criticality of the services affected pursuant to Article 6 (c) RTS to be assumed for every successful, malicious and unauthorised access to the network and information systems of the financial entity, regardless of whether the affected systems support critical or important functions? ### Background The question concerns the reporting obligations for successful, malicious and unauthorised access and the requirements of Article 6 (c) RTS. According to the wording of Article 6 (c) RTS, financial entities determine criticality of services affected based on whether the incident “constitutes or has constituted a successful, malicious and unauthorised access to the network and information systems of the financial entity.” Strictly according to the wording, criticality is to be assumed for each successful, malicious and unauthorised access to network and information systems of the financial entity. The network and information systems do not have to support critical or important functions of the financial entity. However, the definition of a major ICT-related incident according to Article 3 (10) DORA suggests that it only applies to network and information systems that support critical or important functions of the financial entity. Article 6 (a) RTS reiterates the requirement to support critical and important functions, whereas Article 6 (c) RTS does not. This raises question of why this is not the case in Article 6 (c) RTS. The question formulated above is accompanied by the question of whether successful, malicious and unauthorised access to network and information systems by third parties is exempt from Article 6 (c) RTS. According to the wording of Article 6 (c) RTS corresponding accesses to the network and information systems of third parties are not included. The wording explicitly states that access must be gained to the “systems of the financial entity”. *** ### Answer Under Article 6(c) of Commission Delegated Regulation (EU) 2024/1772 ("the RTS") read in conjunction with Recital 5, an incident that constitutes or has constituted a successful, malicious and unauthorised access to the network and information systems of the financial entity must be assessed independently for the purpose of determining the criticality of the services affected, as referred to in Article 18(1)(e) of Regulation (EU) 2022/2554 ("DORA"), regardless of whether the compromised network and information systems support critical or important functions or whether the access to the financial entity's network or systems was gained through the network and information systems of an ICT third-party service provider. Then, as per the article 8(1) of the RTS, such an incident is classified as a major ICT-related incident as per the definition of DORA article 3(10) whenever it has affected critical services as referred to in Article 6 together with the materiality threshold referred to Article 9(5)(b) of the RTS (where any successful, malicious and unauthorised access are considered as well), or with two or more of the other materiality thresholds referred to in Articles 9(1) to (6) of the RTS. Further clarifications about Article 6 of the RTS can be read in DORA Q&A 2024\_7047 *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2026_7779) ## Related Level 1 articles - [Article 18 — Classification of ICT-related incidents and cyber threats](../../../articles/18.md)