|
Number of field
|
Data field
|
|
|
General information about the financial entity
|
|
1.1
|
Type of submission
|
|
|
1.2
|
Name of the entity submitting the report
|
|
|
1.3
|
Identification code of the entity submitting the report
|
|
|
1.4
|
Type of financial entity affected
|
|
|
1.5
|
Name of the financial entity affected
|
|
|
1.6
|
LEI code of the financial entity affected
|
|
|
1.7
|
Primary contact person name
|
|
|
1.8
|
Primary contact person email
|
|
|
1.9
|
Primary contact person telephone
|
|
|
1.10
|
Second contact person name
|
|
|
1.11
|
Second contact person email
|
|
|
1.12
|
Second contact person telephone
|
|
|
1.13
|
Name of the ultimate parent undertaking
|
|
|
1.14
|
LEI code of the ultimate parent undertaking
|
|
|
1.15
|
Reporting currency
|
|
|
Content of the initial notification
|
|
2.1
|
Incident reference code assigned by the financial entity
|
|
|
2.2
|
Date and time of detection of the major ICT-related incident
|
|
|
2.3
|
Date and time of classification of the ICT-related incident as major
|
|
|
2.4
|
Description of the major ICT-related incident
|
|
|
2.5
|
Classification criteria that triggered the incident report
|
|
|
2.6
|
Materiality thresholds for the classification criterion ‘Geographical spread’
|
|
|
2.7
|
Discovery of the major ICT-related incident
|
|
|
2.8
|
Indication whether the major ICT-related incident originates from a third-party provider or another financial entity
|
|
|
2.9
|
Activation of business continuity plan, if activated
|
|
|
2.10
|
Other relevant information
|
|
|
Content of the intermediate report
|
|
3.1
|
Incident reference code provided by the competent authority
|
|
|
3.2
|
Date and time of occurrence of the major ICT-related incident
|
|
|
3.3
|
Date and time when services, activities or operations have been recovered
|
|
|
3.4
|
Number of clients affected
|
|
|
3.5
|
Percentage of clients affected
|
|
|
3.6
|
Number of financial counterparts affected
|
|
|
3.7
|
Percentage of financial counterparts affected
|
|
|
3.8
|
Impact on relevant clients or financial counterparts
|
|
|
3.9
|
Number of affected transactions
|
|
|
3.10
|
Percentage of affected transactions
|
|
|
3.11
|
Value of affected transactions
|
|
|
3.12
|
Information on whether the numbers are actual or estimates, or whether there has not been any impact
|
|
|
3.13
|
Reputational impact
|
|
|
3.14
|
Contextual information about the reputational impact
|
|
|
3.15
|
Duration of the major ICT-related incident
|
|
|
3.16
|
Service downtime
|
|
|
3.17
|
Information on whether the numbers for duration and service downtime are actual or estimates.
|
|
|
3.18
|
Types of impact in the Member States
|
|
|
3.19
|
Description of how the major ICT-related incident has an impact in other Member States
|
|
|
3.20
|
Materiality thresholds for the classification criterion ‘Data losses’
|
|
|
3.21
|
Description of the data losses
|
|
|
3.22
|
Classification criterion ‘Critical services affected’
|
|
|
3.23
|
Type of the major ICT-related incident
|
|
|
3.24
|
Other types of incidents
|
|
|
3.25
|
Threats and techniques used by the threat actor
|
|
|
3.26
|
Other types of techniques
|
|
|
3.27
|
Information about affected functional areas and business processes
|
|
|
3.28
|
Affected infrastructure components supporting business processes
|
|
|
3.29
|
Information about affected infrastructure components supporting business processes
|
|
|
3.30
|
Impact on the financial interest of clients
|
|
|
3.31
|
Reporting to other authorities
|
|
|
3.32
|
Specification of ‘other’ authorities
|
|
|
3.33
|
Temporary actions/measures taken or planned to be taken to recover from the incident
|
|
|
3.34
|
Description of any temporary actions and measures taken or planned to be taken to recover from the incident
|
|
|
3.35
|
Indicators of compromise
|
|
|
Content of the final report
|
|
4.1
|
High-level classification of root causes of the incident
|
|
|
4.2
|
Detailed classification of root causes of the incident
|
|
|
4.3
|
Additional classification of root causes of the incident
|
|
|
4.4
|
Other types of root cause types
|
|
|
4.5
|
Information about the root causes of the incident
|
|
|
4.6
|
Incident resolution summary
|
|
|
4.7
|
Date and time when the incident root cause was addressed
|
|
|
4.8
|
Date and time when the incident was resolved
|
|
|
4.9
|
Information if the permanent resolution date of the incident differs from the initially planned implementation date
|
|
|
4.10
|
Assessment of risk to critical functions for resolution purposes
|
|
|
4.11
|
Information relevant for resolution authorities
|
|
|
4.12
|
Materiality threshold for the classification criterion ‘Economic impact’
|
|
|
4.13
|
Amount of gross direct and indirect costs and losses
|
|
|
4.14
|
Amount of financial recoveries
|
|
|
4.15
|
Information on whether the non-major incidents have been recurring
|
|
|
4.16
|
Date and time of occurrence of recurring incidents
|
|