ICT incident reporting and resilience testing
Domain 3 - ICT incident reporting and resilience testing. This domain tests Chapters III and IV: classification, the reporting clock, and the testing programme including threat-led penetration testing (TLPT).
Classification and reporting
An ICT-related incident is classified against criteria such as clients affected, duration, geographical spread, data loss, criticality of services and economic impact. A major incident triggers an initial notification within four hours of classification and no later than 24 hours after detection; an intermediate report within 72 hours of the initial notification; and a final report within one month of the intermediate report. Reports use the standard templates and go to the competent authority. Significant cyber threats may be notified voluntarily.
Testing
The testing programme must be proportionate and risk-based. All ICT systems and applications supporting critical or important functions must be tested at least annually. TLPT is required at least every three years for significant entities, follows threat-intelligence-led red-team methods, and must be conducted by independent testers meeting Article 27 requirements. Smaller, non-significant entities are not required to perform TLPT.
Worked example
An incident is detected at 09:00 Monday and classified as major at 11:00 Tuesday. The initial notification is due by 15:00 Tuesday (four hours after classification), which is earlier than 09:00 Wednesday (24 hours after detection). The intermediate report is due 72 hours after the initial notification, and the final report one month after the intermediate. Reasoning: both clocks run, and the earlier deadline controls.
Traps
Starting the clock only at classification; missing the 24-hour outer limit; treating every incident as major; confusing annual system testing with three-yearly TLPT; and using internal testers without independence for TLPT.