Circular CSSF 24/847 on ICT-related incident reporting framework

CIRCULAR CSSF 24/847
Circular CSSF 24/847
ICT-related incident reporting framework

CIRCULAR CSSF 24/847
2/24
Circular CSSF 24/847
ICT-related incident reporting framework
To all Supervised Entities within the meaning of the following laws, as amended, and regulations as further specified in point 2:

Law of 5 April 1993 on the financial sector
Law of 15 December 2000 on postal financial services
Law of 10 November 2009 on payment services
Law of 17 December 2010 relating to undertakings for collective investment
Law of 12 July 2013 on alternative investment fund managers
Law of 15 March 2016 on OTC derivatives, central counterparties and trade repositories
Law of 17 April 2018 on benchmarks
Law of 6 June 2018 on Central Securities Depositories
Law of 28 May 2019 on Network and Information Systems
Law of 16 July 2019 on the operationalisation of European regulations in the area of financial
services
Luxembourg, 5 January 2024
Ladies and Gentlemen,
The purpose of this Circular is to introduce a new ICT-related incident reporting framework in order to acquire a better and more structured overview of the nature, frequency, significance and impact of ICT-related incidents, also considering the growing ICT and security risk in the context of a highly interconnected global financial system. The provisions of this Circular are based on Article 53(1) of the Law of 5 April 1993 on the financial sector, as amended (hereafter “LFS”), Article 31(4) of the Law of 10 November 2009 on payment services, as amended (hereafter “LPS”), Article 2 of the Law of 15 December 2000 on postal financial services, as amended, Article 147 of the Law of 17 December 2010 relating to undertakings for collective investment, as amended (hereafter “UCITS Law”), Article 50 of the Law of 12 July 2013 on alternative investment fund managers, as amended (hereafter “AIFM Law”), Article 2(1) of the Law of 15 March 2016 on OTC derivatives, central counterparties and trade repositories, as amended (hereafter “EMIR Law”), Article 2(1) of the Law of 17 April 2018 on benchmarks (hereafter “Benchmark Law”), Article 2 of the Law of 6 June 2018 on Central Securities Depositories (hereafter “CSD Law”), and Article 20-16 of the Law of 16 July 2019 on the operationalisation of European regulations in the area of financial services. According to Article 3 of the Law of 28 May 2019 on Network and Information Systems (hereafter “NIS Law”), the CSSF is also the competent authority in terms of network and information security for the credit institutions and the financial market infrastructures that have been identified as Operators of Essential Services (hereafter “OES”), as well as for Digital Service Providers (hereafter “DSP”) which are already under the supervision of the CSSF (“NIS authority”). The objective of this circular is to lay down the practical details and modalities for the reporting obligations set forth in Articles 8(4), 8(5), 9(1), 11(3) and 11(4) and 12 of the NIS Law and in CSSF Regulation No 24-01

CIRCULAR CSSF 24/847
3/24 relating to the notification of incidents according to the Law of 28 May 20191 (hereafter “CSSF Regulation No 24-01”) regarding specifically Articles 8(5) and 11(3) of the NIS Law. This Circular brings the following changes to the current incident reporting mechanism:

Increases the incident coverage, currently limited to fraud and incidents due to external
computer attacks as per Circular CSSF 11/504, by covering more broadly ICT operational and security incidents while avoiding double reporting for incidents to be notified under other incident notification frameworks.
Introduces reporting based on classification. Supervised Entities will be required to classify ICTrelated incidents based on the criteria indicated in this Circular and to notify to the CSSF the
cases where ICT-related incidents are classified as major or significant incidents.
Introduces a new incident reporting notification form. To obtain data in a structured form,
Supervised Entities will be required to complete and submit an ICT-related incident notification form in case the ICT-related incident is classified as a major or significant incident.
Introduces a specific chapter to cover in the same Circular the incident notification requirements
(previously communicated via bilateral communications to Supervised Entities that are under the scope of the NIS Law) in order to apply the new incident reporting notification forms and practical requirements to the notifications of incidents assessed as significant under the NIS Law. This Circular is divided in four chapters:
Chapter 1 (Definitions and scope of application) sets out the definitions applicable for the
purpose of this Circular and defines the scope of application;
Chapter 2 (General requirements) sets out the requirements for the classification and reporting
of the ICT-related incidents;
Chapter 3 (Specific requirements under the NIS Law and CSSF Regulation No 24-01) is dedicated
to specific requirements for those Supervised Entities that are subject to the NIS Law and CSSF Regulation No 24-01 and that are defined as OES or DSP;
Chapter 4 (Date of application) provides for the entry into force of this Circular.
1 CSSF Regulation No 24-01 of 5 January 2024 relating to the notification of incidents according to the Law of 28 May 2019 transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the European Union.

CIRCULAR CSSF 24/847
4/24
TABLE OF CONTENTS
Chapter 1: Definitions and scope of application................................................................. 5
Section 1.1: Definitions ............................................................................................... 5
Section 1.2: Scope of application.................................................................................. 7
Chapter 2: General requirements .................................................................................... 9
Section 2.1: Incidents to be notified.............................................................................. 9
Section 2.2: ICT-related incident classification................................................................ 9
Section 2.3: Major ICT-related incident notification ....................................................... 10
Chapter 3: Specific requirements under NIS Law and CSSF Regulation No 24-01 ................ 11
Section 3.1: Incident notification by Supervised Entities who are also OES....................... 11
Section 3.2: Incident notification by Supervised Entities who are also DSP....................... 11
Chapter 4: Date of application ...................................................................................... 12

CIRCULAR CSSF 24/847
5/24
Chapter 1: Definitions and scope of application
Section 1.1: Definitions

For the purpose of this Circular, the following definitions apply2:
a) “Network and information system” means:
i. an electronic communications network within the meaning of Article 2, paragraph 1,
of the Law of 17 December 2021 on electronic communications networks and services3;
ii. any device or group of interconnected or related devices, one or more of which,
pursuant to a program, perform automatic processing of digital data; or
iii. digital data stored, processed, retrieved or transmitted by elements covered under
points i. and ii. above for the purposes of their operation, use, protection and maintenance. b) “Security of network and information systems” means the ability of network and information systems to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems. c) “ICT-related incident” means a single event or a series of linked events unplanned by the Supervised Entity that compromises the security of the network and information systems, and has an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the Supervised Entity. d) “Major ICT-related incident” means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the Supervised Entity. e) “Critical or important function” means a function, the disruption of which would materially impair the financial performance of a Supervised Entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a Supervised Entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services laws. f) “Operator of Essential Services” (“OES”) means, in accordance with point (3) of Article 2 of the NIS Law, a public or private entity of a type referred to in the annex to the NIS Law, and which meets the criteria laid down in Article 7(2) of the NIS law4. 2 Definitions in points 1.f) to 1.i) are specific to Supervised Entities subject to the requirements of the NIS Law and CSSF Regulation No 24-01. 3 ‘Electronic communications network’ means transmission systems, whether or not based on a permanent infrastructure or centralised administration capacity, and, where applicable, switching or routing equipment and other resources, including network elements which are not active, which permit the conveyance of signals by wire, radio, optical or other electromagnetic means, including satellite networks, fixed (circuit- and packetswitched, including internet) and mobile networks, electricity cable systems, to the extent that they are used for the purpose of transmitting signals, networks used for radio and television broadcasting, and cable television networks, irrespective of the type of information conveyed. 4 In its competence as NIS authority, the CSSF already notified the relevant Supervised Entities of their identification as OES when the NIS Law entered into force. The CSSF will reconfirm the relevant Supervised Entities of their status as OES at the latest by 1 March 2024. The Supervised Entities which will not receive this notification at that date are therefore not designated as
OES, without prejudice to potential future designation.

CIRCULAR CSSF 24/847
6/24 g) “Digital Service Provider” (“DSP”) means, in accordance with point (5) of Article 2 of the NIS Law, a private entity that provides a digital service as defined in point (4) of Article 2 of the NIS Law5. h) “Essential service” means a service which is essential for the maintenance of critical societal and/or economic activities and which is listed as essential service in Article 2 of CSSF Regulation No 20-04 of 15 July 20206 . i) “Significant incident” means an incident having a significant impact on the continuity of the essential services provided by an OES or on the provision of a digital service provided by a DSP7 within the European Union. For the purpose of this Circular, a significant incident is by default considered as a “Major ICT-related incident”.
2. The following entities are to be considered as Supervised Entities in the frame of this
Circular:
a) credit institutions and professionals of the financial sector within the meaning of the LFS; b) approved publication arrangements (APAs) with a derogation and authorised reporting mechanisms (ARMs) with a derogation within the meaning of the LFS; c) payment institutions and electronic money institutions within the meaning of the LPS; d) POST Luxembourg governed by the Law of 15 December 2000 on postal financial services8; e) management companies incorporated under Luxembourg law and subject to Chapter 15 of the UCITS Law; f) management companies incorporated under Luxembourg law and subject to Articles 125- 1 or 125-2 of Chapter 16 of the UCITS 2010 Law; g) Luxembourg branches of IFMs subject to Chapter 17 of the UCITS Law; h) investment companies which did not designate a management company within the meaning of Article 27 of the UCITS Law; i) alternative investment fund managers authorised under Chapter 2 of the AIFM Law; j) internally managed alternative investment funds within the meaning of point (b) of
Article 4(1) of the AIFM Law;
k) central counterparties (CCPs) within the meaning of Article 2(1) of EMIR9, including Tier 2 third-country CCPs within the meaning of Article 25(2a) of EMIR, complying with the relevant requirements of EMIR in accordance with point (a) of Article 25(2b) of EMIR; l) central securities depositories within the meaning of the CSD Law; 5 In its competence as NIS authority, the CSSF already informed relevant Supervised Entities of their consideration as DSP when the NIS Law entered into force. The CSSF will reconfirm the relevant Supervised Entities of their status as DSP at the latest by 1 March 2024. The Supervised Entities which will not receive this information at that date are therefore not considered as DSP, without prejudice to potential future information. 6 CSSF Regulation No 20-04 of 15 July 2020 on the definition of essential services under the Law of 28 May 2019 transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 on measures to ensure a common high level of network and information system security in the European Union. 7 Definition in alignment with the NIS Law. 8 For the sake of clarity, the wording “postal financial services” has the meaning provided for in Article 1 of the Law of 15 December 2000, as amended. 9 Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories.

CIRCULAR CSSF 24/847
7/24 m) administrators of critical benchmarks within the meaning of point (b) of Article 20(1) of the Benchmark Regulation10; n) crowdfunding Service Providers within the meaning of the Law of 16 July 2019 on the operationalisation of European regulations in the area of financial services; o) credit institutions and the financial market infrastructures for which according to Article 3 of the NIS Law the CSSF is the competent authority in terms of network and information security and that have been identified as OES, p) support PSF authorised in accordance with Article 29-3 of the LFS for which according to
Article 3 of the NIS Law the CSSF is the competent authority in terms of network and
information security and that have been informed by the CSSF of their consideration as DSP under the NIS Law.
Section 1.2: Scope of application
3. This Circular defines the supervisory expectations that must be complied with in the event
of an ICT-related incident.
4. The provisions of Chapter 2 (General requirements) of this Circular are applicable to all
Supervised Entities as defined in point 2 a) to n) above, hereinafter collectively referred to as “Supervised Entities” or individually as “Supervised Entity”, including their branches as specified in the respective laws. Branches in Luxembourg of Entities incorporated in a third country shall be deemed to be included in the notion of Supervised Entity.
5. Branches in Luxembourg of the Entities that are part of a legal entity whose head office is
located in a different Member State of the European Economic Area (EEA) (EEA branches) are subject to the supervision of the competent authority of that Member State (home Member State). However, as the CSSF is competent for ensuring that EEA branches comply with the specific requirements laid down in the sectoral legal and regulatory frameworks11, this Circular applies if an ICT-related incident impacts areas for which the CSSF retains an oversight responsibility.
6. The provisions of Chapter 3 (Specific requirements under the NIS Law and CSSF Regulation
No 24-01) of this Circular are only applicable to those Supervised Entities that are also OES4 or DSP5.
7. With the aim of preventing double reporting, Supervised Entities in scope of this Circular are
not required to notify under this Circular the incidents they notify in compliance with:
a) Circular CSSF 21/787 on the “Application of the EBA Guidelines (EBA/GL/2021/03) on Major Incident Reporting under PSD2”, and/or; b) Cyber Incident Reporting for Supervised Entities defined as significant institutions falling under the direct supervision of the ECB, and/or; c) Article 45(6) of Regulation (EU) No 909/2014 on notification of incidents resulting from the risks that key participants, service and utility providers, other central securities 10 Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014. 11 Notably in the context of investment services in accordance with the MiFID Law, the AML/CFT Law, the provision of asset management services and depositary tasks for Undertakings for Collective Investments established in Luxembourg.

CIRCULAR CSSF 24/847
8/24 depositories (CSDs) or other market infrastructures might pose to the CSD’s operations, and/or; d) Article 71(4)(b) of Commission Delegated Regulation (EU) 2017/392 of 11 November 2016 supplementing Regulation (EU) No 909/2014 on reporting of material operational incidents to the competent authority.
8. By way of exception from point 7 above, Supervised Entities falling under by point 7.b) and
who are also OES, are required to report to the CSSF as per this Circular those incidents that impact the continuity of the essential services they provide, in addition to their other incident reporting obligations.

CIRCULAR CSSF 24/847
9/24
Chapter 2: General requirements
Section 2.1: Incidents to be notified
9. Supervised Entities shall notify the following incidents in accordance with the procedure
defined in section 2.3:
a) Any successful malicious unauthorised access to the network and information systems. For the purpose of this circular these successful malicious unauthorised accesses are to be considered as major ICT-related incidents. b) Any incident other than those referred to in point a) above, classified in line with section
2.2 as major ICT-related incident.
Section 2.2: ICT-related incident classification
10. Supervised Entities shall classify ICT-related incidents and assess their impact on the basis
of the following criteria:
a) the number and/or relevance of clients12 or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact; b) the duration of the ICT-related incident, including the service downtime; c) the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States; d) the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality; e) the criticality of the services affected, including the Supervised Entity’s transactions and operations; f) the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.
11. When the Supervised Entity's internal assessment based on the criteria listed under point
10 leads the Supervised Entity to classify an ICT-related incident as major, the ICT-related incident shall be considered as major under this circular.
12. In the case the assessment referred under point 11 does not lead to a clear outcome on
whether the ICT-related incident has to be classified as major, Supervised Entities shall report the ICT-related incident to the CSSF.
13. Supervised Entities shall classify the ICT-related incident in a timely manner after the ICTrelated incident has been detected, and without undue delay after the information required
for the classification of the ICT-related incident is available to the Supervised Entities, but no later than 24 hours after the detection of that ICT-related incident. If longer time is needed to classify the ICT-related incident, Supervised Entities shall explain in the initial notification submitted to the competent authority the reasons thereof. Where the deadline 12 Supervised Entities who are also OES shall consider the number of users affected by the disruption to the essential service. Supervised Entities who are also DSP shall consider the number of users affected by the incident, in particular those who use the digital service to provide their own services.

CIRCULAR CSSF 24/847
10/24 for classification falls on a weekend day or a bank holiday, Supervised Entities may classify the incident on the next working day.
Section 2.3: Major ICT-related incident notification
14. Supervised Entities shall, within the time limits laid down in Annex I, submit the following
notifications of major ICT-related incidents to the CSSF:
a) An initial notification with "Initial Information" when the ICT-related incident has been classified as major. b) An intermediate notification with “Incident cause, classification and impact” after the initial notification referred to in point 14.a), followed by, as appropriate, updated notifications each time a relevant update is available, as well as upon specific request by the CSSF. c) A final notification, when the root cause analysis has been completed, regardless of whether mitigation measures have been fully implemented, and when the actual impact figures are available to replace estimates. In this notification Supervised Entities can add any follow-up and additional information that is deemed relevant for the ICT-related incident.
15. When the ICT-related incident proves to have or will potentially have a very serious impact
(e.g., complete unavailability of the systems), the Supervised Entity shall notify the CSSF as soon as possible within the given timeframe, and if necessary, before the formal submission of the notification form.
16. ICT-related incident notifications referred to in point 14 shall be submitted via the
corresponding form available using the CSSF digital solution as further specified on the CSSF website.
17. Supervised Entities shall complete the relevant section of the notification form, depending
on the phase they are in (i.e., section “Initial information” for initial notification, section “Incident cause, classification and impact” for intermediate notification and section “Root cause – Follow-up and additional information” for final notification). The notification form contains the data fields laid down in Annex II.
18. The sections of the notification form must be submitted in the order indicated in point 14.
Should the Supervised Entity have all the information required available at the time of the initial notification, a single submission (containing all the sections of the notification form) shall be made.
19. Supervised Entities shall also notify the competent authority when, as a result of the
continuous assessment of the ICT-related incident, it is identified that an already reported ICT-related incident no longer fulfils the criteria to be considered major and is not expected to fulfil them before the ICT-related incident is resolved. In this case, Supervised Entities shall reclassify the ICT-related incident as soon as this circumstance is detected and provide an explanation of the reasons justifying this reclassification in the section “Initial information” of the notification form.
20. Supervised Entities may outsource the reporting obligations under this chapter to a thirdparty provider. In case of such outsourcing, the Supervised Entity remains fully responsible
for the fulfilment of the ICT-related incident reporting requirements within the applicable timeline and for the whole content of the incident reporting.

CIRCULAR CSSF 24/847
11/24
Chapter 3: Specific requirements under NIS Law and CSSF
Regulation No 24-01
Section 3.1: Incident notification by Supervised Entities who
are also OES
21. In compliance with Article 8(4) of the NIS Law, Supervised Entities who are also OES shall
notify, without undue delay, the CSSF of incidents having a significant impact on the continuity of the essential services they provide. The notion of “without undue delay” is considered complied with when Supervised Entities submit their incident notification in line with the time limits indicated in section 2.3 (Major ICT-related incident notification) and in
Annex I.
22. In this respect, in compliance with Article 8(5) of the NIS Law and CSSF Regulation No 24-
01, Supervised Entities who are also OES shall assess whether an incident is to be classified as a significant incident by applying mutatis mutandis the requirements stated in section 2.2 (ICT-related incident classification) and shall notify the significant incidents in compliance with the requirements stated in section 2.3 (Major ICT-related incident notification).
23. Successful malicious unauthorised accesses have to be considered by default as significant
incidents and shall be notified in compliance with the requirements stated in section 2.3 (Major ICT-related incident notification).
24. When an incident is classified both as a significant incident and as a major ICT-related
incident (e.g., the incident impacts both essential services under NIS and other critical or important functions), Supervised Entities who are also OES shall notify only once the incident and indicate in their notification that the incident is also notified under the NIS Law.
Section 3.2: Incident notification by Supervised Entities who
are also DSP
25. Article 11(3) of the NIS Law and CSSF Regulation No 24-01 mentions that DSPs shall notify,
without undue delay, the competent authority of incidents having a significant impact on the provision of a digital service they provide within the European Union. The notion of “without undue delay” is considered complied with when Supervised Entities submit their incident notification in line with the time limits indicated in section 2.3 (Major ICT-related incident notification) and in Annex I.
26. Supervised Entities who are also DSP shall:
a) assess whether an incident (including successful malicious unauthorised accesses, as defined under point 9.a) of section 2.1) is to be classified as a significant incident in line with Articles 3 and 4 of Commission Implementing Regulation (EU) 2018/151 of 30 January 201813 providing details on Article 11(4) of the NIS Law; 13 Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact.

CIRCULAR CSSF 24/847
12/24 b) apply mutatis mutandis points 12 and 13 of section 2.2 (ICT-related incident classification); c) notify the significant incidents in compliance with the requirements stated in section 2.3 (Major ICT-related incident notification).
27. When an incident is classified both as a significant incident and as a major ICT-related
incident, Supervised Entities who are also DSP shall notify only once the incident and indicate in their notification that the incident is also notified under the NIS Law.
Chapter 4: Date of application
28. This Circular shall enter into force on 1 April 2024 for the Supervised Entities as defined in
point 2 a) to d) and k) to p) in Section 1.1., and on 1 June 2024 for the Supervised Entities as defined in point 2 e) to j) in Section 1.1. The Circular will repeal and replace Circular CSSF 11/504 on “Frauds and incidents due to external computer attacks” on 1 April 2024 for the Supervised Entities as defined in point 2 a) to d) and k) to p) in Section 1.1. and on 1 June 2024 for the Supervised Entities as defined in point 2 e) to j) in Section 1.1. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annexes I. Deadlines and explanations for submission of notifications
II. Data fields

CIRCULAR CSSF 24/847 13/24
Annex I: Deadlines and explanations for submission of notifications
Relevant section to be filled in and submitted Deadlines Explanatory notes N/A Classification of the incident as major Within 24 hours after the detection of the ICTrelated incident Where the deadline for classification falls on a weekend day or a bank holiday, Supervised Entities may classify the incident on the next working day. Classification of the incident as major Reminder of point 15:
When the ICT-related incident proves to have or will potentially have a very serious impact (e.g., complete unavailability of the systems), the Supervised Entity shall notify the CSSF as soon as possible within the given timeframe, and if necessary, before the formal submission of the notification form. INITIAL INFORMATION Within 4 hours after the classification of the incident as major Where the deadline for notification falls on a weekend day or a bank holiday, Supervised Entities may notify the incident on the next working day. The “INITIAL INFORMATION” section contains the general information about the incident that shall be included in the notification the first time it is submitted. INCIDENT CAUSE, CLASSIFICATION AND IMPACT Within 3 working days after the submission to the CSSF of the INITIAL INFORMATION The section “INCIDENT CAUSE, CLASSIFICATION AND IMPACT” provides a more detailed description of the incident, its consequences and the corrective measures that were taken to

CIRCULAR CSSF 24/847
14/24 recover. If the Supervised Entity has updates to previous reports (of the same incident), an updated version of the section of the form may be submitted. ROOT CAUSE – FOLLOW-UP AND ADDITIONAL INFORMATION Within 20 working days after the submission to the CSSF of the INCIDENT CAUSE, CLASSIFICATION AND IMPACT The section “ROOT CAUSE – FOLLOW-UP AND ADDITIONAL INFORMATION” provides information regarding the root cause analysis, lessons learned and any other relevant information. When submitting this information, the Supervised Entity shall review the other sections of the form and update these, where appropriate.

CIRCULAR CSSF 24/847
15/24
Annex II: Data fields
Section – Initial Information
Data Field description / Question Field type Proposed options

Contact person within the supervised entity for updates: Name and surname
Alphanumeric
Contact person within the supervised entity for updates: Email Alphanumeric (email format)
Contact person within the supervised entity for updates: Phone Number (telephone format)
Second contact person within the supervised entity for updates: Name and
surname
Alphanumeric
Second contact person within the supervised entity for updates: Email Alphanumeric (email format)
Second contact person within the supervised entity for updates: Phone Number (telephone format)
Country(ies) affected by the incident
Choice (multiple) - Select all that apply
List of world countries
Date and time of detection of the incident yyyy-mm-dd hh:mm
Date and time of classification of the incident as major
yyyy-mm-dd hh:mm
Criteria triggering the major ICT-related incident report
Choice (multiple) - Select all that apply

Clients or financial counterparts
affected
Transactions affected
Reputational impact
Service downtime
Geographical spread
Data losses entailed in relation to
availability, authenticity, integrity or confidentiality
Criticality of the services affected
Economic impact

CIRCULAR CSSF 24/847
16/24
Data Field description / Question Field type Proposed options
7. The incident was detected by
Choice (multiple) – Select one option

IT security
Staff member
Internal audit
Consumer / payment service user
External auditor
Third party provider
Attacker / warning
Other
7.1. If "Other", specify Alphanumeric

General description of the incident
Provide a general description of the incident, its immediate impact and including the measures that have been taken so far Alphanumeric
Short description of impact in other EU member states Alphanumeric
Has the incident been reported to other authorities? Boolean (Checkbox)
10.1. If checkbox was ticked, specify Alphanumeric
If the incident caused a service interruption, is the service restored (even
in degraded mode) at the time of this notification?
Alphanumeric
Is the incident notified under NIS (Network Information System)
framework?
Boolean (Checkbox)

CIRCULAR CSSF 24/847
17/24
Section – Incident cause, classification and impact
Data Field description / Question Field type Proposed options

Detailed description of the incident,
Provide a detailed description of the incident, including (if known and/or applicable):

How the incident started
Background and incident detection, who was involved, what happened, how did
it evolve?
Cause of the incident
Alphanumeric

What are the main areas/systems/channels that were affected as the incident
evolved?
Alphanumeric
Was it related to a previous incident(s)?
Boolean
(Checkbox)
3.1. If checkbox was ticked, specify Alphanumeric
Date and time of beginning of the incident - if known
yyyy-mm-dd hh:mm
Who is leading the investigation of the incident?
Choice (multiple) –
Select one option

Group
Supervised entity
Service provider
Security company
Other

Cause and type
6.1. Details regarding incident cause and type (Select all that apply).
Select at least one of the main options. Then, as applicable, select the subcategories Choice (multiple) - Select all that apply

Under investigation
Malware
Social engineering
Insider/Third Party Provider Threat
Intrusion/Unauthorised access

CIRCULAR CSSF 24/847
18/24
Data Field description / Question Field type Proposed options

Denial of service
System/Process failure
Human error
Other
6.1.1. If "Other", specify Alphanumeric
6.2. As applicable, select the subcategories
Choice (multiple) -
Select all that apply
Malware
o Ransomware o Trojan horse o Virus/Worm/Spyware o Other (Malware)
Social engineering
o Phishing/*ishing o Other (Social engineering)
Insider/Third Party Provider Threat
o Accidental data leakage/corruption o Intentional misuse of access rights by insider o Intentional misuse of access rights by service provider o Other (Insider/Third Party Provider Threat)
Intrusion/Unauthorised access
o Brute force attack o Malicious script injection and/or OS commanding o Unauthorized use of resources, copyright o Account/application compromise o Other exploited vulnerability o Other (Intrusion/Unauthorised access)
Denial of service
System/Process failure
o Hardware failure o Software/application failure o Network failure o Database/Storage failure o Physical damage o Other (System/Process failure)

CIRCULAR CSSF 24/847
19/24
Data Field description / Question Field type Proposed options

Human error
Other

If this incident is related to a cyber-attack, provide information regarding the
attacker(s) (select all that apply)
Choice (multiple) -
Select all that apply

Terrorists
Hacktivists
Foreign agencies
Inside job/Unaware employee
Unknown
Other
7.1. If "Other", specify Alphanumeric

Users impacted
8.1. Number of internal users impacted Numeric
Actual or estimated
Choice (multiple) –
Select one option

Actual figure
Estimation
Not yet available
8.1.1. As a % total internal users (values allowed from 0 to 100, rounded, no
decimals, percentage sign not allowed)
Numeric
Actual or estimated
Choice (multiple) –
Select one option
Actual figure
Estimation
Not yet available
8.2. Number of customers impacted Numeric
Actual or estimated
Choice (multiple) –
Select one option
Actual figure
Estimation
Not yet available
8.2.1. As a % total customers (values allowed from 0 to 100, rounded, no decimals,
percentage sign not allowed)
Numeric
Actual or estimated
Choice (multiple) –
Select one option
Actual figure
Estimation
Not yet available

CIRCULAR CSSF 24/847
20/24
Data Field description / Question Field type Proposed options
9. Service downtime?
Boolean
(Checkbox)
9.1. If checkbox was ticked, provide the total service downtime (DD:HH:MM)
Alphanumeric
(DD:HH:MM)
Actual or estimated
Choice (multiple) –
Select one option

Actual figure
Estimation
Not yet available

Economic impact
10.1. Direct financial loss in EUR Numeric
Actual or estimated
Choice (multiple) –
Select one option

Actual figure
Estimation
Not yet available
10.2. Indirect financial loss in EUR Numeric
Actual or estimated
Choice (multiple) –
Select one option
Actual figure
Estimation
Not yet available

Were crisis management (or equivalent) procedures activated or is it likely to
be activated?
Boolean
(Checkbox)
11.1. If checkbox was ticked, specify the actions taken Alphanumeric
Were any legal or regulatory requirements breached?
Boolean
(Checkbox)
12.1. If checkbox was ticked, specify Alphanumeric
Was there any media coverage?
Boolean
(Checkbox)
13.1. If checkbox was ticked, specify the media/newspapers/blogs that covered
the topic
Alphanumeric

CIRCULAR CSSF 24/847
21/24
Data Field description / Question Field type Proposed options
14. Overall impact (select all that apply) Choice (multiple) -
Select all that apply

Integrity
Availability
Confidentiality
Reputational

Was the incident affecting you directly, or indirectly through a service provider?
Choice (multiple) –
Select one option

Directly
Indirectly
15.1. If "Indirectly", specify the service provider's name Alphanumeric

Other impacts Alphanumeric
Corrective actions/measures that have been taken so far or are planned to
recover from the incident
Alphanumeric
Was a business continuity plan activated? If yes, when and how?
Boolean
(Checkbox)
18.1. Date and time
yyyy-mm-dd hh:mm
18.2. Describe Alphanumeric
Was a disaster recovery plan activated? If yes, when and how?
Boolean
(Checkbox)
19.1. Date and time
yyyy-mm-dd hh:mm
19.2. Describe Alphanumeric
Is the incident in any way related to remote access (e.g., teleworking, remote
connectivity, etc.)?
Boolean
(Checkbox)
20.1. If checkbox was ticked, specify Alphanumeric

CIRCULAR CSSF 24/847
22/24
Section - Root cause, follow-up and additional information
Data Field description / Question Field type Proposed options

Additional information
Provide details regarding the following: Lessons learned (including main actions/measures taken/planned to prevent the incident from happening again in the future) Alphanumeric 2.Root cause and/or Vulnerabilities/weaknesses identified (select all that apply) Choice (multiple) – Select all that apply

Inadequate Change Management
Migration failure
Inadequacy of internal procedures and documentation
Improper operations
Latency issues
Recovery issues
Lack of staff awareness and/or compliance
Unauthorised software/wrong version
Inadequate privileged account management
Inadequate email/web browser protection
Inadequate malware defences
Inadequate identity access management
Inadequate security configurations for secure hardware
and software on devices, laptops, workstations, servers
Inadequate boundary defences
Inadequate control of network ports, protocols and
services
Inadequate resilience and/or back-up of systems or files
Unsecured network devices (firewalls, routers, switches)
Inadequate maintenance and monitoring of logs
Inadequate DDoS defences
Inadequate penetration and security testing
Inadequate patch management
Inadequate application software security controls (webbased and other applications)
Other

CIRCULAR CSSF 24/847
23/24
Data Field description / Question Field type Proposed options
2.1. If "Other", specify Alphanumeric
3. Other relevant information on the root cause (e.g., What
went wrong with the change, New technical vulnerability exploited, etc.) Alphanumeric
4. If this incident is related to a cyber-attack, what was the
entry vector of the incident? (select all that apply) Choice (multiple) – Select all that apply

Website
Instant messaging
Phone
Insider attack (privileged user)
E-mail
Third party network
Unauthorised devices
Insider attack (regular / business users)
Lost / stolen devices
Chat rooms / social media
Other
4.1. If "Other", specify Alphanumeric

Who is leading the remediation actions? Choice (multiple) –
Select one option

Group
Supervised entity
Service provider
Security company
Other
5.1. If "Other", specify Alphanumeric

Are Police/other security agencies involved in the
investigation?
Choice (multiple) –
Select one option

Police
Other
None
6.1. If "Other", specify Alphanumeric

If the incident is related to ICT security, was the incident
reported to the national CERT (e.g., CIRCL, GOVCERT)?
Boolean (Checkbox)
Has any legal action been taken (e.g., complaint with
prosecutor against provider or perpetrator)?
Boolean (Checkbox)

CIRCULAR CSSF 24/847
24/24
Data Field description / Question Field type Proposed options
8.1. If checkbox was ticked, specify Alphanumeric
9. Assessment of the effectiveness of the action taken Choice (multiple) –
Select one option

Highly effective
Moderately effective
Not effective
Not yet available
9.1. Details Alphanumeric

What is the current status of the incident? Choice (multiple) –
Select one option

Resolved
Contained
Ongoing
Unknown
10.1. Provide the date and time when then incident was closed
or is expected to be closed if known yyyy-mm-dd hh:mm

Circular CSSF 24/847 on ICT-related incident reporting framework

Lineage: Superseded

Timeline

Similar documents from other regulators