Recital 51
Digital Operational Resilience Act · UE 2022/2554
| (51) | The propagators of cyber-attacks tend to pursue financial gains directly at the source, thus exposing financial entities to significant consequences. To prevent ICT systems from losing integrity or becoming unavailable, and hence to avoid data breaches and damage to physical ICT infrastructure, the reporting of major ICT-related incidents by financial entities should be significantly improved and streamlined. ICT-related incident reporting should be harmonised through the introduction of a requirement for all financial entities to report directly to their relevant competent authorities. Where a financial entity is subject to supervision by more than one national competent authority, Member States should designate a single competent authority as the addressee of such reporting. Credit institutions classified as significant in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should submit such reporting to the national competent authorities, which should subsequently transmit the report to the European Central Bank (ECB). |
In Luxembourg, the CSSF is the single designated competent authority for receiving DORA major ICT incident notifications for nearly all regulated financial entities (credit institutions, PFS, payment institutions, EMIs, UCIs, AIFMs, investment firms). For SSM Article 6(4) significant institutions, the CSSF then transmits to the ECB. The law of 1 June 2023 amending the law of 5 April 1993 on the financial sector and the applicable CSSF circulars (in particular CSSF 24/847 on incident reporting) set out the operational channels (dedicated eDesk portal) and timelines.
Luxgap practice: configure your incident orchestrator with a primary CSSF eDesk channel and a secondary CNPD channel for mixed ICT and personal-data incidents, avoiding any parallel submission to the BCL unless a payment system is explicitly concerned.
