Article 8 Notification of significant cyber threats

This brief article addresses the procedural requirements for financial entities that choose to notify competent authorities of significant cyber threats.

It mirrors the approach taken in earlier articles of this regulation regarding major ICT-related incident reporting, but applies specifically to the voluntary notification pathway for significant cyber threats under DORA.

Rather than leaving the format open-ended, the article directs financial entities to use a dedicated template and accompanying glossary — namely Annex III and Annex IV — and places a clear obligation on the accuracy and completeness of the information submitted.

Important points:

• Use Annex III as the prescribed template and Annex IV as the data glossary when notifying competent authorities of significant cyber threats.
• Ensure all information submitted in the notification is complete and accurate.
• This article applies specifically to the voluntary notification of significant cyber threats, which are threats that could potentially result in a major ICT-related incident, as distinct from the mandatory major incident reporting covered elsewhere in the regulation.