Article 6 Criticality of services affected

Summary What does Article 6 of the RTS on incident classification say?

This article specifies how financial entities should determine whether the services affected by an incident are critical, which is one of the criteria listed under Article 18(1) of DORA for classifying incidents.

It provides three distinct angles from which criticality can be established: whether core ICT systems supporting critical or important functions were hit, whether regulated financial services were disrupted, or whether a malicious and unauthorised access to network and information systems took place.

Notably, this article also feeds directly into Article 8, which sets out the conditions for classifying an incident as a major incident — meaning a finding of criticality here is a prerequisite for that classification.

Important points:

Assess whether an incident has affected ICT services or network and information systems that support critical or important functions of your organisation.
Assess whether the incident has disrupted financial services that are subject to authorisation, registration, or supervisory oversight.
Assess whether the incident involved a successful, malicious, and unauthorised access to your network and information systems.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

For the purpose of determining the criticality of the services affected as referred to in Article 18(1), point (e), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident:

affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;
affects or has affected financial services provided by the financial entity that require authorisation, registration or that are supervised by competent authorities;
constitutes or has constituted a successful, malicious and unauthorised access to the network and information systems of the financial entity.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.

Relevant recitals