CroatiaZakon o provedbi Uredbe (EU) 2022/2554, Competent Authorities, Incident Reporting and Fines for Financial Entities
čl. 7, 14 i 19, Zakon o provedbi Uredbe (EU) 2022/2554 (NN 136/2024)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Reporting
As of .
What it requires
- If you are a financial entity supervised by HANFA or the Croatian National Bank under Article 8 of the Act, report each significant ICT incident to HANFA (or to the Croatian National Bank, for the entities it supervises) and to the CSIRT (Article 14).NIST CSF 2.0RS.CO-02
- Make those reports through the national platform for cyber threats and incidents set up under the cybersecurity law (Article 15).NIST CSF 2.0RS.CO-02
- Set up the internal governance and control framework that ensures effective and prudent management of ICT risk, as DORA Article 5(1) requires (Article 19(1), item 1).NIST CSF 2.0GV.RR-01
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Private right of actionNo
Penalty structure
Article 19(1) sets a misdemeanour fine of at most 3 percent of the legal person's total annual revenue for the failures it lists, such as not establishing the ICT risk governance and control framework required by DORA Article 5(1).
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
The Croatian Financial Services Supervisory Agency (HANFA) and the Croatian National Bank, the competent authorities under Article 7(1) of the Act.
Settledness
- As of
What this law does
The Croatian Financial Services Supervisory Agency (HANFA) and the Croatian National Bank are the competent authorities for implementing the DORA Regulation (Regulation (EU) 2022/2554) and the Act (Article 7). Entities supervised by the Agency must report significant ICT incidents to the Agency, those supervised by the Croatian National Bank must report them to the Bank, and all supervised entities must also report to the CSIRT (Article 14).
Supervised entities must report significant ICT incidents through the national platform for cyber threats and incidents set up under the cybersecurity law (Article 15). A legal person that has not set up the internal governance and control framework for managing ICT risk required by DORA Article 5(1) is fined up to 3 percent of its total annual revenue (Article 19). The Act took effect on (Article 22).
When LexLint raises it
When your app profile says your app provides financial services.