As part of the mechanisms to detect anomalous activities, including ICT network performance issues and ICT-related incidents, financial entities shall develop, document, and implement an ICT-related incident policy through which they shall:
(a)
document the ICT-related incident management process referred to in Article 17 of Regulation (EU) 2022/2554;
(b)
establish a list of relevant contacts with internal functions and external stakeholders that are directly involved in ICT operations security, including on:
(i)
the detection and monitoring of cyber threats;
(ii)
the detection of anomalous activities;
(iii)
vulnerability management;
(c)
establish, implement, and operate technical, organisational, and operational mechanisms to support the ICT-related incident management process, including mechanisms to enable a prompt detection of anomalous activities and behaviours in accordance with Article 23 of this Regulation;
(d)
retain all evidence relating to ICT-related incidents for a period that shall be no longer than necessary for the purposes for which the data are collected, commensurate with the criticality of the affected business functions, supporting processes, and ICT and information assets, in accordance with Article 15 of Commission Delegated Regulation (EU) 2024/1772 ( 12 ) and with any applicable retention requirement pursuant to Union law;
(e)
establish and implement mechanisms to analyse significant or recurring ICT-related incidents and patterns in the number and the occurrence of ICT-related incidents.
For the purposes of point (d), financial entities shall retain the evidence referred to in that point in a secure manner.
Anomalous activities detection and criteria for ICT-related incidents detection and response
1. Financial entities shall set clear roles and responsibilities to effectively detect and respond to ICT-related incidents and anomalous activities.
2. The mechanism to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, as referred to in Article 10(1) of Regulation (EU) 2022/2554, shall enable financial entities to:
(a)
collect, monitor, and analyse all of the following:
(i)
internal and external factors, including at least the logs collected in accordance with Article 12 of this Regulation, information from business and ICT functions, and any problem reported by users of the financial entity;
(ii)
potential internal and external cyber threats, considering scenarios commonly used by threat actors and scenarios based on threat intelligence activity;
(iii)
ICT-related incident notification from an ICT third-party service provider of the financial entity detected in the ICT systems and networks of the ICT third-party service provider and that may affect the financial entity;
(b)
identify anomalous activities and behaviour, and implement tools generating alerts for anomalous activities and behaviour, at least for ICT assets and information assets supporting critical or important functions;
(c)
prioritise the alerts referred to in point (b) to allow for the management of the detected ICT-related incidents within the expected resolution time, as specified by financial entities, both during and outside working hours;
(d)
record, analyse, and evaluate any relevant information on all anomalous activities and behaviours automatically or manually.
For the purposes of point (b), the tools referred to in that point shall contain the tools that provide automated alerts based on pre-defined rules to identify anomalies affecting the completeness and integrity of the data sources or log collection.
3. Financial entities shall protect any recording of the anomalous activities against tampering and unauthorised access at rest, in transit and, where relevant, in use.
4. Financial entities shall log all relevant information for each detected anomalous activity enabling:
(a)
the identification of the date and time of occurrence of the anomalous activity;
(b)
the identification of the date and time of detection of the anomalous activity;
(c)
the identification of the type of the anomalous activity.
5. Financial entities shall consider all of the following criteria to trigger the ICT-related incident detection and response processes referred to in Article 10(2) of Regulation (EU) 2022/2554:
(a)
indications that malicious activity may have been carried out in an ICT system or network, or that such ICT system or network may have been compromised;
(b)
data losses detected in relation to the availability, authenticity, integrity, and confidentiality of data;
(c)
adverse impact detected on financial entity’s transactions and operations;
(d)
ICT systems’ and network unavailability.
6. For the purposes of paragraph 5, financial entities shall also consider the criticality of the services affected.
