7. Financial entities should estimate the aggregated annual costs and losses by applying the follow …

Financial entities should estimate the aggregated annual costs and losses by applying the follow sequential steps:

• (a) estimate the costs and losses of each major ICT-related incident as referred to in paragraph 6 individually. Those estimations should produce the gross costs and losses taking into account the types of costs and losses as set out in Article 7(1) and (2) of the Commission Delegated Regulation [OJ L, 2024/1772, 25.6.2024];
• (b) for each major ICT-related incident, financial entities should also estimate the financial recoveries as specified in Annex II to Commission Implementing Regulation [OJ L, 2025/302, 20.2.2025]⁷ ;
• (c) financial entities should aggregate the gross costs and losses and the financial recoveries across major ICT-related incidents.

⁷ Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/