NIST CSF 2.0, RespondRS.MA-03

On discovering or becoming aware of a cybersecurity incident affecting your own operations, grade it against China's four-tier National Cybersecurity Incident Classification and Grading Guide (especially major, major, relatively major, ordinary), and report only where you grade it relatively major or above; an ordinary incident carries no report duty under this instrument.

If you hold a private data network, ensure that a cybersecurity event or incident affecting it is recorded, classified and reported to CuCERT.

Treat an incident as significant, and notify it under Article 23 of Directive (EU) 2022/2555, where it fulfils one or more of the criteria of Article 3(1): direct financial loss, caused or capable of being caused, that exceeds EUR 500,000 or 5 percent of your total annual turnover in the preceding financial year, whichever is lower; the exfiltration of your trade secrets; the death of a natural person or considerable damage to a natural person's health; a successful, suspectedly malicious and unauthorised access to your network and information systems that is capable of causing severe operational disruption; or the recurring-incident rule or a criterion for your class of entity.

Apply the criteria that Articles 5 to 14 set for your class of entity: Article 5 for DNS service providers, Article 6 for TLD name registries, Article 7 for cloud computing service providers, Article 8 for data centre service providers, Article 9 for content delivery network providers, Article 10 for managed service providers and managed security service providers, Articles 11 to 13 for providers of online marketplaces, online search engines and social networking services platforms, and Article 14 for trust service providers.

This Regulation details the classification of incidents under Article 18 of Regulation (EU) 2022/2554, so it reaches you if you are a financial entity under Article 2(1), points (a) to (t), of that Regulation, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). Use these criteria to decide whether an ICT-related incident is a major incident that you must report under Article 19(1) of that Regulation.

Classify an ICT-related incident as major where it has affected critical services, meaning it affects ICT services or network and information systems that support your critical or important functions, affects financial services that require authorization, registration or supervision, or is a successful, malicious and unauthorized access to your network and information systems, and either the data losses threshold of Article 9(5), point (b), is met or two or more of the other materiality thresholds of Article 9(1) to (6) are met (Articles 6 and 8(1)).

Where you are one of the providers Commission Implementing Regulation (EU) 2024/2690 names, apply the significance criteria of its Articles 3 to 14 to decide which incidents to notify, which its recital 30 treats as exhaustive.

Take account, where available, of the number of users affected, the duration of the incident, its geographical spread, the extent to which the network or service is affected and the extent of its impact on economic and societal activities when judging whether an incident has a significant impact (regulation 28(4)).

In the process, establish procedures to identify, track, log, categorize and classify ICT-related incidents according to their priority and severity and the criticality of the services impacted, in accordance with the criteria set out in Article 18(1) (Article 17(3)(b)).

Enter each cyber incident in the cyber incident log within 24 hours of detecting it, assess its significance at once, and report a significant incident to the competent cyber incident prevention institution on the early warning, initial report, progress report, intermediate report and final report forms within the clocks of Article 34 of the Law (points 47, 117 and 119).

Assess whether the breach is likely to adversely affect a subscriber or individual by taking account of, in particular, the nature and content of the personal data (financial information, special categories of data referred to in Article 8(1) of Directive 95/46/EC, location data, internet log files, web browsing histories, e-mail data and itemized call lists), the likely consequences for the person (identity theft or fraud, physical harm, psychological distress, humiliation or damage to reputation), and the circumstances of the breach, in particular where the data has been stolen or you know it is in the possession of an unauthorized third party (Article 3(2)).