+Incident Tracking

Incident Tracking

Develop procedures to identify, track, log, categorize, and classify ICT-related incidents based on priority, severity, and criticality of impacted services. Maintain records of all ICT-related incidents and significant cyber threats. Implement a monitoring process to track incidents and cyber threats.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations
EULAW Article 13 2

2.   Financial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11.

Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph.

The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following:

(a)

the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity;

(b)

the quality and speed of performing a forensic analysis, where deemed appropriate;

(c)

the effectiveness of incident escalation within the financial entity;

(d)

the effectiveness of internal and external communication.
EULAW Article 14 3

3.   At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.
EULAW Article 17 1

1.   Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.
EULAW Article 17 2

2.   Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.
EULAW Article 17 3

3.   The ICT-related incident management process referred to in paragraph 1 shall:

(a)

put in place early warning indicators;

(b)

establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);

(c)

assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;

(d)

set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;

(e)

ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;

(f)

establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.
EULAW Article 19 1

1.   Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article.

Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article.

Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB.

For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means.

The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts.

Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.
EULAW Article 19 2

2.   Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.

Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, may, on a voluntary basis, notify significant cyber threats to relevant national competent authority, designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit the notification to the ECB.

Member States may determine that those financial entities that on a voluntary basis notify in accordance with the first subparagraph may also transmit that notification to the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.
EULAW Article 19 3

3.   Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident.

In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.
EULAW Article 19 4

4.   Financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:

(a)

an initial notification;

(b)

an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority;

(c)

a final report, when the root cause analysis has been completed, regardless of whether mitigation measures have already been implemented, and when the actual impact figures are available to replace estimates.
EULAW Article 19 5

5.   Financial entities may outsource, in accordance with Union and national sectoral law, the reporting obligations under this Article to a third-party service provider. In case of such outsourcing, the financial entity remains fully responsible for the fulfilment of the incident reporting requirements.
EULAW Article 22 Politique de gestion des incidents liés aux TIC

Article 22

Politique de gestion des incidents liés aux TIC

Dans le cadre des mécanismes de détection des activités anormales, y compris des problèmes de performance des réseaux de TIC et des incidents liés aux TIC, les entités financières élaborent, documentent et mettent en œuvre une politique en matière d’incidents liés aux TIC dans le cadre de laquelle elles:

a) 

documentent le processus de gestion des incidents liés aux TIC visé à l’article 17 du règlement (UE) 2022/2554;

b) 

établissent une liste des contacts pertinents avec les fonctions internes et les parties prenantes externes qui sont directement associées à la sécurité des opérations de TIC, notamment en ce qui concerne:

i) 

la détection et le suivi des cybermenaces;

ii) 

la détection des activités anormales;

iii) 

la gestion des vulnérabilités;

c) 

établissent, mettent en œuvre et gèrent des mécanismes techniques, organisationnels et opérationnels pour soutenir le processus de gestion des incidents liés aux TIC, notamment des mécanismes permettant de détecter rapidement les activités et comportements anormaux conformément à l’article 23 du présent règlement;

▼C1

d) 

conservent tous les éléments de preuve relatifs aux incidents liés aux TIC pendant une durée qui n’excède pas celle nécessaire à la réalisation des finalités pour lesquelles les données sont collectées, et qui est proportionnée à la criticité des fonctions «métiers», des processus d’appui et des actifs de TIC et informationnels affectés, conformément à l’article 8, paragraphe 2, du règlement délégué (UE) 2024/1772 de la Commission ( 2 ) et à toute exigence en matière de conservation applicable en vertu du droit de l’Union;

▼B

e) 

établissent et mettent en œuvre des mécanismes permettant d’analyser les incidents importants ou récurrents liés aux TIC et les caractéristiques relatives au nombre et à la fréquence des incidents liés aux TIC.

Aux fins du point d), les entités financières conservent les éléments de preuve visés audit point de manière sécurisée aux fins dudit point.
EULAW Article 23 1.
Les entités financières définissent clairement les rôles et les responsabilités pour ce qui est de détecter efficacement les incidents liés aux TIC et les activités anormales et d’y répondre.
EULAW Article 23 5.

Pour déclencher les processus de détection des incidents liés aux TIC et de réponse à ces incidents visés à l’article 10, paragraphe 2, du règlement (UE) 2022/2554, les entités financières tiennent compte de l’ensemble des critères suivants:

a) 

des éléments indiquant qu’une activité malveillante est susceptible d’avoir été menée dans un système ou un réseau de TIC, ou que ce système ou réseau de TIC est susceptible d’avoir été compromis;

b) 

des pertes de données détectées en lien avec la disponibilité, l’authenticité, l’intégrité et la confidentialité des données;

c) 

une incidence négative détectée sur les transactions et opérations de l’entité financière;

d) 

l’indisponibilité des systèmes et réseaux de TIC.
  • NOREA -

    EN: DORA in Control Framework of NOREA, the Dutch professional association of IT auditors, https://www.norea.nl/. © NOREA. Reproduced with the permission of NOREA; converted into the GRCA format. Only the version published by NOREA is authoritative.

    DE: DORA in Control Framework von NOREA, dem niederländischen Berufsverband der IT-Auditoren, https://www.norea.nl/. © NOREA. Wiedergabe mit Genehmigung von NOREA; in das GRCA-Format umgewandelt. Maßgeblich ist allein die von NOREA veröffentlichte Fassung.