What it asks for. Financial entities must classify ICT-related incidents and determine their impact using criteria set out in the article, and classify cyber threats as significant based on the criticality of the services at risk.
In practice. The incident criteria include the number and relevance of clients or financial counterparts affected and the amount or number of transactions affected, reputational impact, duration and service downtime, geographical spread across Member States, data losses affecting availability, authenticity, integrity or confidentiality, the criticality of services affected, and economic impact. Regulatory technical standards set materiality thresholds that determine when an incident is major. Doing this well means a classification procedure embedded in incident management, with each criterion assessed and recorded, and recurring incidents with the same apparent root cause analysed together. Evidence includes classification records and timestamps.
Common gaps. Gaps include classifying incidents too late, missing the economic or data loss criteria, and not aggregating recurring smaller incidents that together qualify as major.