6. A SIPS operator shall have procedures in place to ensure that at least any major cyber incidents that negatively impact the SIPS, including incidents originating with the SIPS participants and third-party service providers, are reported to: (a) the Board, the Management, and, where applicable, the Branch Management; and (b) the competent authority. A SIPS operator shall have in place processes of continuous learning and improvement related to cyber security. These processes shall include, for instance, ensuring that the cyber resilience framework considers threat developments as well as reviews of cyber incidents with lessons learned.