Duty to report significant incidents

Catalog reference

Report every significant incident under arts. 26 to 29 (art. 25(1)). An incident is significant if it causes or can cause a severe operational disruption of the services or financial loss for the entity, or has affected or can affect other entities by causing considerable material or non-material damage (art. 25(2)). A ministerial regulation or decision can set criteria for what is significant, by sector, subsector, type of entity or entity; for the entities where EU implementing acts under Directive (EU) 2022/2555 art. 23(11) already say when an incident is significant, it can add criteria (art. 25(3) and (4)); Cyberbeveiligingsbesluit art. 23 gives the competent minister that power, requires them to evaluate the criteria at least every four years, and requires an entity that holds a decision that is specific to it to keep that decision confidential in its organisation. For government bodies, the Cyberbeveiligingsregeling sector overheid (BWBR0052963, art. 6) sets the criteria. In the central government subsector an incident is significant if it leads or can lead to an outage of the service of at least four hours, financial damage to the State or society of more than 500 million euros, serious injury or death of at least one person, misuse of business information with financial damage of more than 5 million euros, or unauthorised disclosure of confidential information at least at the level Staatsgeheim CONFIDENTIEEL, NATO CONFIDENTIAL or EU CONFIDENTIAL. In the decentralised government subsector it is significant if it leads or can lead to an outage of the service of at least four hours, financial consequences that the budget cannot absorb, or serious injury or death of at least one person. A planned service interruption or planned effect of maintenance is not a significant incident. The Cyberbeveiligingsregeling IenW (BWBR0052878, arts. 14 to 28) sets the criteria for the sectors it covers: transport, drinking water, wastewater, waste management, chemicals, research and others, and for waterschappen in art. 28 (the same three criteria as the decentralised government subsector).

Narrative — how we satisfy this requirement