Artikel 6 De berörda tjänsternas kritikalitet

Summary What does Article 6 of the RTS on incident classification say?

This article specifies how financial entities should determine whether the services affected by an incident are critical, which is one of the criteria listed under Article 18(1) of DORA for classifying incidents.

It provides three distinct angles from which criticality can be established: whether core ICT systems supporting critical or important functions were hit, whether regulated financial services were disrupted, or whether a malicious and unauthorised access to network and information systems took place.

Notably, this article also feeds directly into Article 8, which sets out the conditions for classifying an incident as a major incident — meaning a finding of criticality here is a prerequisite for that classification.

Important points:

Assess whether an incident has affected ICT services or network and information systems that support critical or important functions of your organisation.
Assess whether the incident has disrupted financial services that are subject to authorisation, registration, or supervisory oversight.
Assess whether the incident involved a successful, malicious, and unauthorised access to your network and information systems.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

För att fastställa de berörda tjänsternas kritikalitet enligt artikel 18.1 e i förordning (EU) 2022/2554 ska finansiella entiteter bedöma huruvida incidenten

påverkar eller har påverkat IKT-relaterade tjänster eller nätverks- och informationssystem som stöder kritiska eller viktiga funktioner hos den finansiella entiteten,
påverkar eller har påverkat finansiella tjänster som tillhandahålls av den finansiella entiteten och som kräver tillstånd eller registrering eller som står under tillsyn av behöriga myndigheter,
utgör eller har utgjort en framgångsrik, skadlig och obehörig åtkomst till den finansiella entitetens nätverks- och informationssystem.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.

Relevant recitals