ESAs publish report on centralising ICT incident reporting in the financial sector

Article summary

The three European Supervisory Authorities (the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority—ESAs) have published a report on the feasibility of further centralisation in the reporting of major information and communication technology (ICT)-related incidents by financial entities (a single EU Hub), as mandated by Article 21 of the Digital Operational Resilience Act (DORA). The report explores the potential for centralisation in the reporting process and assesses three models: the baseline model, a model with enhanced data sharing arrangements, and a fully centralised model. It evaluates the potential burden, cost reductions, and the efficiency and effectiveness gains each model could bring to cross-sector supervisory practices.