Q&A 2026_7779, published as definitive in  the Single Rulebook of the European Supervisory Authorities (EBA, ESMA and EIOPA), interprets Art. 6, letter c), of Delegated Regulation (EU) 2024/1772 on the DORA regulatory framework on the classification of ICT incidents. Successful, malicious and unauthorised access to a financial entity's network and information systems must be assessed independently for the purposes of the "criticality of the services concerned", even if the compromised systems do not support critical or important functions and even if the access passed through the network of an ICT third-party provider.

The clarification prevents triage  from ruling out an incident just because a system deemed non-critical has been affected or because the initial vector is at the supplier. However, it does not mean that every intrusion is automatically a major incident: the overall classification requires the application of the thresholds and other criteria of the delegated regulation.

For banks, insurance companies and other DORA entities, it is useful to update the SOC Playbooks and incident classification procedures, providing for documented verification of successful access and severity criteria even in vendor compromise scenarios. Contracts and escalation flows  with ICT third parties should make available in time the logs and facts necessary for the assessment and any notifications.