Article 10 – High materiality thresholds for determining significant cyber threats

For the purposes of Article 18(2) of Regulation (EU) 2022/2554, a cyber threat shall be considered significant where all of the following conditions are fulfilled:

1. the cyber threat, if materialised, could affect or could have affected critical or important functions of the financial entity, or could affect other financial entities, third-party providers, clients or financial counterparts, based on information available to the financial entity;
2. the cyber threat has a high probability of materialisation at the financial entity or at other financial entities, taking into account at least the following elements:
   1. applicable risks related to the cyber threat referred to in point (a), including potential vulnerabilities of the systems of the financial entity that can be exploited;
   2. the capabilities and intent of threat actors to the extent known by the financial entity;
   3. the persistence of the threat and any accrued knowledge about incidents that have impacted the financial entity or its third-party provider, clients or financial counterparts;
3. the cyber threat could, if materialised, meet any of the following:
   1. the criterion regarding criticality of services set out in Article 18(1), point (e), of Regulation (EU) 2022/2554, as specified in Article 6 of this Regulation;
   2. the materiality threshold set out in Article 9(1);
   3. the materiality threshold set out in Article 9(4).

Where, depending on the type of cyber threat and available information, the financial entity concludes that the materiality thresholds set out in Article 9(2), (3), (5) and (6) could be met, those thresholds may also be considered.