Critical ICT incident reporting
What this control requires
All major ICT incidents impacting payment services, customer data or availability must be classified within 4 hours and reported under DORA timelines including initial, intermediate and final reports.
Other CTIF/CFI controls
BE_CTIF_CFI-CTRL-001 - Daily safeguarding reconciliationBE_CTIF_CFI-CTRL-003 - GDPR breach notification workflowBE_CTIF_CFI-CTRL-004 - AML suspicious transaction monitoringBE_CTIF_CFI-CTRL-005 - Quarterly PCI vulnerability assessmentBE_CTIF_CFI-CTRL-006 - Outsourcing provider oversightBE_CTIF_CFI-CTRL-007 - DORA Register of Information maintenanceBE_CTIF_CFI-CTRL-008 - CTIF suspicious activity escalationBE_CTIF_CFI-CTRL-009 - NIS2 cyber resilience testingBE_CTIF_CFI-CTRL-010 - Instant payment availability monitoringCTIF-001-001 - CTIF-CFI Declaration ObligationsCTIF-002-001 - CTIF Cooperation and Information RequestsCTIF-003-001 - AML Declaration Quality Management