art_13__para_2

2. Financial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11. Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph. The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following: the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity; the quality and speed of performing a forensic analysis, where deemed appropriate; the effectiveness of incident escalation within the financial entity; the effectiveness of internal and external communication.

← art_13__para_1 · All articles · art_13__para_2__para →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.