Communiqué regarding new reporting procedure for ICT-related incident reporting according to Circular CSSF 24/847

Published on 27 March 2024 Email this Share this on LinkedIn Share this on Facebook Communiqué Communiqué regarding new reporting procedure for ICT-related incident reporting according to Circular CSSF 24/847 As indicated in our communiqué published on 5 January 2024 related to ICT-related incident reporting, we publish today further guidance related to the submission channels and procedure to be followed when submitting an ICT-related incident notification under Circular CSSF 24/847. We remind Supervised Entities that this circular enters into force on 1 April 2024 for the Supervised Entities as defined in point 2

1. a)to
2. d)and
3. k)to
4. p)in Section 1.1., and on 1 June 2024 for the Supervised Entities as defined in point 2
5. e)to
6. j)in Section 1.1. and on these dates repeals and replaces Circular CSSF 11/504 on “Frauds and incidents due to external computer attacks”. Subsequently, on these dates the new reporting methods and procedures described here below come into effect. Notifications shall be submitted via one of the two below methods: Dedicated procedure on CSSF eDesk Portal Notifications shall be submitted via the procedure “Major ICT-related Incident Notification”. The procedure is only accessible to the dedicated user role “IT Incident Notifier”. This role must be assigned by the “Advanced User” of the Supervised Entities in eDesk before ICT-related incident notifications can be accessed and submitted. The role shall be attributed to the person/s most suitable to draft and submit the notification to the CSSF, nevertheless no specific sign-off is required. For further details on how to assign this role refer to the on the eDesk Portal homepage. Application Programming Interface (“API”) solution S3 Notifications can also be submitted via an API solution based on the use of a structured exchange file (.json format) to be transmitted to the CSSF via the S3 (“simple storage service”) protocol, using the “IT Expert” role. This role must be assigned by the “Advanced User” of the Supervised Entities in eDesk before ICT-related incident notifications can be submitted through S3. In terms of logistics, the “IT Incident Notifier” as well as the “IT Expert” must have an eDesk account, which requires a LuxTrust authentication. To avoid connection issues when the procedure becomes mandatory on 1 April and 1 June respectively, the CSSF invites all Supervised Entities to ensure they have set-up the relevant eDesk accounts and enrolled as necessary. Procedure for submission of major ICT-related Incident Notification To help Supervised Entities with the submission of their notifications a detailed user guide on Major ICT-related Incident Notification has been developed and is available on the eDesk Portal. This user guide explains the procedures for completing and submitting the ICT-related incident notifications with both channels. For further assistance, the following email addresses are at your disposal: Any question regarding authentication or account creation, or technical issues in submitting a notification, should be addressed to eDesk@cssf.lu. Any question relating to the circular, the timeline or the content of the ICT-related incident notifications should be addressed to ictrisksupervision@cssf.lu. 27 March 2024 - Updated on 17 January 2025 Circular CSSF 24/847 Major ICT-related incident notification, DORA Major ICT-related incident and significant cyber threats reporting User guide Technical document PDF (2.93Mb) Relevant for Management companies - Chapter 16 Payment institutions Specialised PFS Support PFS CSSF 24/847 Major ICTrelated incident notification, DORA Major ICT-related incident and significant cyber threats reporting - User Guide CSSF 24/847 Major ICT-related incident notification, DORA Major ICT-related incident and significant cyber threats reporting - User Guide TABLE OF CONTENTS 1. Introduction.................................................................................................................. 4 2. Connection to the eDesk portal ....................................................................................... 5 2.1. Authentication and connection to the eDesk portal ....................................................... 5 2.2. Access to the 2 notification procedures ....................................................................... 5 2.3. CSSF 24/847 incident reports form ............................................................................ 6 2.3.1. Dashboard of CSSF 24/847 incident reports notifications ......................................... 6 2.3.2. Creation of a new notification .............................................................................. 7 2.3.2.1. Description of the notification form structure .................................................... 8 2.3.2.1.1.Navigation Menu (A)................................................................................... 8 2.3.2.1.2.The information to be filled in by the Supervised Entity (B) ............................. 9 2.3.2.1.3.Information and validation (C) ................................................................... 10 2.3.2.2. Filling in the first draft of a notification .......................................................... 10 2.3.2.3. Deletion of a draft notification ...................................................................... 11 2.3.2.4. Submission of a draft notification .................................................................. 12 2.3.3. Modification of a submitted notification ............................................................... 13 2.3.4. Reclassification of an incident ............................................................................ 14 2.3.5. Addition of document(
7. s)to the notification form ................................................... 15 2.3.6. Exchange of comment(
8. s)with the CSSF .............................................................. 16 2.4. DORA - Major ICT-related incident notification form ................................................... 17 2.4.1. Dashboard of DORA - Major ICT-related incident notifications ................................ 18 2.4.2. Creation of a new notification ............................................................................ 19 2.4.2.1. Description of the notification form structure .................................................. 19 2.4.2.1.1.Navigation Menu (A)................................................................................. 20 2.4.2.1.2.The information to be filled in by the Supervised Entity (B) ........................... 20 2.4.2.1.3.Information and validation (C) ................................................................... 21 2.4.2.2. Filling in the first draft of a notification .......................................................... 21 2.4.2.3. Deletion of a draft notification ...................................................................... 22 2.4.2.4. Submission of a draft notification .................................................................. 23 2.4.3. Modification of a submitted notification ............................................................... 24 2.4.4. Reclassification of an incident ............................................................................ 25 2.4.5. Addition of document(
9. s)to the notification form ................................................... 26 2.4.6. Exchange of comment(
10. s)with the CSSF .............................................................. 27 2.5. DORA - Significant Cyber Threat Reports .................................................................. 28 2.5.1. Dashboard of DORA - Significant Cyber Threat Reports notifications ....................... 28 2.5.2. Creation of a new notification ............................................................................ 29 2.5.2.1. Description of the notification form structure .................................................. 30 2.5.2.1.1.Navigation Menu (A)................................................................................. 30 2.5.2.1.2.The information to be filled in by the Supervised Entity (B) ........................... 30 2.5.2.1.3.Information and validation (C) ................................................................... 31 2.5.2.2. Filling in the first draft of a notification .......................................................... 31 CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 2/44 2.5.2.3. Deletion of a draft notification ...................................................................... 32 2.5.2.4. Submission of a draft notification .................................................................. 32 2.5.3. Modification of a submitted notification ............................................................... 34 2.5.4. Addition of document(
11. s)to the notification form ................................................... 35 2.5.5. Exchange of comment(
12. s)with the CSSF .............................................................. 36 3. Notification via the S3 solution ...................................................................................... 37 3.1 Overview of the S3 solution and prerequisite ............................................................. 37 3.2 Reporting file......................................................................................................... 38 3.2.1 Reporting format and naming convention ............................................................ 38 3.2.2 Submission process .......................................................................................... 39 3.2.3 Modification of a submitted notification ............................................................... 39 3.2.3.1 Reclassification of an incident ....................................................................... 39 3.2.3.1 Addition of document(
13. s)to the updated notification ........................................ 40 3.2.4 3.3 Consistency verification rules ............................................................................. 40 CSSF feedback file ................................................................................................. 40 3.3.1 Naming convention ........................................................................................... 41 3.3.2 CSSF Feedback file content ................................................................................ 41 3.3.2.1 Technical validation..................................................................................... 42 3.3.2.1.1 “Rejected” Status ..................................................................................... 42 3.3.2.1.1 “Accepted” Status ..................................................................................... 42 3.3.2.2 Business validation ..................................................................................... 43 3.3.2.2.1 “Draft” status ........................................................................................... 43 3.3.2.2.1 “Submitted” status ................................................................................... 44 CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 3/44 1. Introduction Circular CSSF 24/847 and the application of DORA require entities subject to the supervision of the CSSF to notify the CSSF of major ICT-related incidents, while also allowing for the notification of significant cyber threats. These notifications are required to be submitted through the respective eDesk procedures, called : • “CSSF 24/847 Major ICT-related incident notification” procedure, • “DORA Major ICT-related incident and significant cyber threat notification” procedure, or via an API (S3 protocol), both established by the CSSF. The eDesk portal allows Supervised Entities for CSSF 24/847 incident reports and DORA - Major Incident Reports to:
14. a)fill in and submit major ICT-related incident notifications with attachments in three phases: Initial notification (“Initial information”); Intermediate report (“Incident cause, classification and impact”); and Final report (“Root cause, follow up and additional information”).
15. b)exchange comments with the CSSF regarding each notified major ICT-related incident.
16. c)submit updates of notifications when applicable. The eDesk portal allows Supervised Entities for DORA - Significant Cyber Threat Reports to :
17. a)fill in and submit major ICT-related incident notifications with attachments.
18. b)exchange comments with the CSSF regarding each notified major ICT-related incident.
19. c)submit updates of notifications when applicable. The S3 protocol allows Supervised Entities to perform
20. a)and
21. c)above. Definitions, criteria, notification deadlines and other details regarding the reporting obligations are available in Circular CSSF 24/847. The purpose of this document is to guide the user(
22. s)for: 1. the completion and submission of the above-mentioned procedures accessible on the eDesk portal; 2. the completion and submission of the above-mentioned procedures via the S3 protocol. Should Supervised Entities experience difficulties in creating an account or in case of technical difficulties to submit a notification, please contact the CSSF via email at: edesk@cssf.lu Should Supervised Entities have any questions in relation to the timeline or the content of the notifications to be submitted, please contact the CSSF via email at: ictrisksupervision@cssf.lu CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 4/44 2. Connection to the eDesk portal 2.1. Authentication and connection to the eDesk portal Important: The prerequisites enabling the connection to eDesk and the initiation of a notification (activation of an entity link, …) are detailed in the eDesk Authentication User Guide in the eDesk portal home page (https://edesk.apps.cssf.lu/edesk-dashboard/dashboard/getstarted). Please refer to the eDesk Authentication User Guide. 2.2. Access to the 2 notification procedures From the eDesk homepage, to find the 2 notification procedures, click on the “Access to procedures” button and then type “Major ICT” in the “Advanced search” bar. The user can select the corresponding procedure by clicking the corresponding link. Important: The “IT Incident Notifier” role is required to access and manage the filing of Major ICTrelated Incident Notifications. The roles existing in eDesk and allowing access to this eDesk module are detailed in the eDesk Authentication User Guide in the eDesk portal home page (https://edesk.apps.cssf.lu/edesk-dashboard/dashboard/getstarted). Please request the role from the advanced user of your entity. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 5/44 For information, the eDesk homepage screen is split as follows: • The Header is the upper part of the screen where the user can find: o The navigation menu that shows several useful links. “CSSF.lu” takes the user back to the CSSF website. “About the CSSF” and “Privacy policy” take the user to the dedicated CSSF website sections respectively about CSSF itself and its privacy policy. o The language option (FR or EN) is available on each screen, and it is possible to switch between languages throughout the authentication procedure. o The “Log in” button takes the user to the screen to be used to connect to the eDesk portal. o The “Procedures” button takes the user to the “Log in” page if the user is not connected yet or the procedures list. •The Toolbox gathers several e-services (modules) that do not require an authentication. • The News section presents the latest information related to eDesk. • The Footer at the bottom of the screen is non-interactive. 2.3. CSSF 24/847 incident reports form The following actions are possible: • Creation of a new notification • Modification of a submitted notification • Reclassification of an incident • Addition of document(
23. s)to the notification form • Exchange of comment(
24. s)with the CSSF 2.3.1. Dashboard of CSSF 24/847 incident reports notifications When connecting to the modules, the main part of the page is a dashboard providing a general view of all the notifications created by the Supervised Entity, with usual filtering and sorting functionalities. The dashboard for CSSF 24/847 incident reports contains the following columns: - Reference: Reference of CSSF 24/847 incident reports notification, automatically assigned once a notification is submitted, - Entity code: CSSF code of the Supervised Entity, CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 6/44 - Status 1: Status of the 1st section of the form “Initial information”. The value of each status can be either “Draft”, “Submitted” or “Closed”, - Status 2: Status of the 2nd section of the form “Incident cause, classification and impact”, - Status 3: Status of the 3rd section of the form “Root cause, follow up and additional information”, - Submission Date 1: Date of submission of the 1st section of the form, - Submission Date 2: Date of submission of the 2nd section of the form, - Submission Date 3: Date of submission of the 3rd section of the form, - Origin: The submission channel through which the incident was submitted to the CSSF. The value will be either “eDesk” or “S3”, - Action(s): The Supervised Entity can “open” the notification form by clicking on the “folder” icon. The entity can also double-click on a given line to consult a form. Above the dashboard, a top banner contains several links and useful information: • a link to the global eDesk dashboard (by clicking on the eDesk logo or “Home”), • a link to the procedures accessible by the connected Supervised Entity user (by clicking on “Procedures”), • the name of the user connected and corresponding Supervised Entity name (not visible in the above illustration), with a small arrow on the right which can be used to access: o the “User profile” by clicking “Manage profile”, o the “Entity management” (available only for the advanced users), and o the Logout functionality. Below the top banner is a button labelled “CREATE A NEW INCIDENT REPORT”, which allows the Supervised Entity to create a new incident notification. Further details are provided in the next section. 2.3.2. Creation of a new notification To create a new major ICT-related incident notification, the user shall click on the “CREATE A NEW INCIDENT REPORT” button on the dashboard page. Once the button is clicked, a new incident notification page opens. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 7/44 To ease the navigation within the form, sub-sections can be reduced by clicking on the greyed out sub-section’s title. 2.3.2.1. Description of the notification form structure 2.3.2.1.1. Navigation Menu (A) The left part of the screen is dedicated to: • the navigation within the 3 sections of the CSSF 24/847 incident reports notification form, that is: • o “Initial information”, o “Incident cause, classification and impact”, o “Root cause, follow up and additional information” “CSSF 24/847 incident reports: this allows the Supervised Entity to return to the main dashboard and access the ongoing or completed notifications. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 8/44 2.3.2.1.2. The information to be filled in by the Supervised Entity (B) The main part of the notification page devoted to form information, identified in the figure above as “B”, is the part of the screen where the metadata relating to the incident notification is displayed. This part is made up of the following sub-sections: • B1: “INSTRUCTIONS TO FILL OUT THE TEMPLATE” • B2: “Form”, • B3: “Documents”, and • B4: “Comments” 1. INSTRUCTIONS TO FILL OUT THE TEMPLATE (B1) “INSTRUCTIONS TO FILL OUT THE TEMPLATE” is only available in the first section, “Initial information”, of the incident notification form. It provides, amongst others, general information regarding the structure of the notification, the reporting deadlines to be met by the supervised entities and the possibilities for reclassification of the incident. 2. Form (B2) The “Form” part contains the questions related to the incident, to be answered by the Supervised Entity. This part exists in the 3 sections of the notification form. Explanatory notes are available by hovering over the “question mark” symbol to provide further explanations regarding the information to be provided by the Supervised Entity. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 9/44 2.3.2.1.3. Information and validation (C) The “Information & validation” section of the screen covers the following: • “Report information”: Provides general information of the Supervised Entity such as the Supervised Entity’s name, and code, the status of the notification, the creation date and the user who created the notification. • “Inconsistencies report”: Displays the potential missing information and inconsistencies to be resolved by the Supervised Entity before submitting the notification to the CSSF. • “Actions”: These are action buttons that represent actions that can be taken by the user at any given point in time. Actions could be for example Submit, Delete or Modify. When actions are “greyed”, the action button cannot be clicked. This may be because the report is incomplete, or the incident has already been closed on the CSSF side. 2.3.2.2. Filling in the first draft of a notification Once a new incident notification form is created, the user can fill in the information requested. The user can complete and submit the relevant sections of the notification form. Each section of a notification form can be accessed by clicking on the corresponding name of the section in the navigation Menu. - Initial information: This section gathers the general information about the incident. - Incident cause, classification and impact: This second section provides a more detailed description of the incident, its consequences and the corrective measures that were taken to recover. - Root cause, follow up and additional information: This third section provides information regarding the root cause analysis, lesson learned and any other relevant information. When submitting this information, the Supervised Entity shall review the other sections and update these, where appropriate. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 10/44 The user shall always save the information filled-in by clicking on the “Save” button at the bottom of the section prior to submitting any section of an incident notification. Any saved section will have the status “Draft” and will not yet be visible by the CSSF. The draft data already saved can be deleted any time before the information is submitted to the CSSF via the dedicated “Delete” action button. 2.3.2.3. Deletion of a draft notification A notification at status “Draft” can be deleted by the Supervised Entity by clicking on the “Delete” action button in the “Information & validation” section. Any deleted notification cannot be restored and shall be started over. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 11/44 2.3.2.4. Submission of a draft notification A notification can be submitted by clicking the “Submit” action button in the “Information & validation” section. The system automatically prevents the user from submitting any incomplete notification form to the CSSF. In such case, the system will display a list of the missing data at the top of the form, as well as in the “Inconsistencies report” in the right section. Once the form is filled-in with the mandatory information and the changes are saved, the “Submit” button will be enabled. When clicking on the “Submit” button, a confirmation window will pop up for the user to confirm the requested action. The user will have to confirm this action for the notification to be submitted to the CSSF. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 12/44 Once confirmed, the status of this submitted section of the notification will change to “Submitted” and its respective submission date will be automatically displayed in the “Report information” section, as well as in the dashboard. A dedicated reference will also be automatically assigned to this submitted notification. Unlike the status, the filing reference is unique for the 3 sections of an incident notification. Important: The section “Initial information” of a notification shall be submitted first, followed by the section “Incident cause, classification and impact”, and lastly the section “Root cause, follow up and additional information”. 2.3.3. Modification of a submitted notification If the Supervised Entity has updates to an incident report already submitted, an updated version of the form may be submitted. In this case, the user shall click on the action “Modify”, that is only available at status “Submitted”. A new information “Last submission date” is then displayed in the “Report information” for the user to easily differentiate a new form from an update of an already submitted one. For any modification of an already submitted form, the user must complete the section “Summary of changes made to previous report”. A modified form reverts to the status “Draft” and must be saved and submitted again via the “Submit” action, for the CSSF to receive the updated information. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 13/44 Any new ongoing version of a form can be deleted via the “Delete” action, which, if confirmed via the usual popup window, brings the user back to its previous submitted version. Important: An incident notification with the status “Closed” can no longer be modified. New document(
25. s)or comment(
26. s)can however still be added and submitted. 2.3.4. Reclassification of an incident In case the incident no longer fulfils the criteria to be considered as major, the user can reclassify the incident notification in the system. The incident shall then be reclassified as minor by ticking the dedicated box at the top of the “Initial information” section of the notification form. Supervised entities must provide the date and an explanation of the reasons for this reclassification. This option is only available after the initial submission of the notification form. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 14/44 2.3.5. Addition of document(
27. s)to the notification form The “Documents” part allows the user to attach document(
28. s)to its notification where applicable. To add a document, follow the steps below: 1. Click on the “Add” button. 2. A new window will open allowing the user to upload a new document. Note: only pdf extension is authorized. The document is then uploaded and attached to the dedicated section with status “Draft” and can be downloaded or deleted by the user. Document(
29. s)attached to a specific section of an incident notification are submitted to the CSSF together with the corresponding section of the “Form”, via the action “Submit”. Document(
30. s)added to closed files shall be submitted individually. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 15/44 The deletion action remains available until the section is submitted to the CSSF, changing the status of the document to “Active”. 2.3.6. Exchange of comment(
31. s)with the CSSF The “Comments” part allows the CSSF and supervised entities to exchange comments about the information submitted in the form. New comments can be created by clicking on “Add”. A new window will be displayed, allowing the user to write a text. The user shall then click on the “Save” button to save the entered text. The comment will then be displayed in the dedicated “Comments” section and can be respectively “Edited”, “Published to the CSSF”, or “Deleted” via the action buttons. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 16/44 Important: The “Save” button will only save a draft version of a comment but will not send the comment to the CSSF. To send a comment to the CSSF, the user shall click on the “Publish” icon and confirm the action in the popup window. Once the comment is published to the CSSF it can no longer be edited or deleted. The comments published by the CSSF to the Supervised Entity will be visible in the same section. Those comments have the CSSF logo before the name of the CSSF agent who published it. Comments can be added and published any time after the initial submission of the “Initial information” section. 2.4. DORA - Major ICT-related incident notification form The following actions are possible: • Creation of a new notification • Modification of a submitted notification • Reclassification of an incident • Addition of document(
32. s)to the notification form • Exchange of comment(
33. s)with the CSSF CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 17/44 2.4.1. Dashboard of DORA - Major ICT-related incident notifications When connecting to the modules, the main part of the page is a dashboard providing a general view of all the notifications created by the Supervised Entity, with usual filtering and sorting functionalities. The dashboard for DORA - Major Incident Reports contains the following columns: - Reference: Reference of the DORA - Major ICT-related incident notification, automatically assigned once a notification is submitted, - Entity code: CSSF code of the Supervised Entity, - Status 1: Status of the 1st section of the form “Initial notification”. The value of each status can be either “Draft”, “Submitted” or “Closed”, - Status 2: Status of the 2nd section of the form “Intermediate report”, - Status 3: Status of the 3rd section of the form “Final report”, - Submission Date 1: Date of submission of the 1st section of the form, - Submission Date 2: Date of submission of the 2nd section of the form, - Submission Date 3: Date of submission of the 3rd section of the form, - Origin: The submission channel through which the incident was submitted to the CSSF. The value will be either “eDesk” or “S3”, - Action(s): The Supervised Entity can “open” the notification form by clicking on the “folder” icon. The entity can also double-click on a given line to consult a form. Above the dashboard, a top banner contains several links and useful information: • a link to the global eDesk dashboard (by clicking on the eDesk logo or “Home”), • a link to the procedures accessible by the connected Supervised Entity user (by clicking on “Procedures”), • the name of the user connected and corresponding Supervised Entity name (not visible in the above illustration), with a small arrow on the right which can be used to access: o the “User profile” by clicking “Manage profile”, o the “Entity management” (available only for the advanced users), and o the Logout functionality. Below the top banner is a button labelled “CREATE A NEW DORA INCIDENT REPORT” which allows the Supervised Entity to create a new incident notification. Further details are provided in the next section. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 18/44 2.4.2. Creation of a new notification To create a new major ICT-related incident notification, the user shall click on the “CREATE A NEW DORA INCIDENT REPORT”, button on the dashboard page, depending on the selected form. Once the button is clicked, a new incident notification page opens. To ease the navigation within the form, sub-sections can be reduced by clicking on the greyed out sub-section’s title. 2.4.2.1. Description of the notification form structure CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 19/44 2.4.2.1.1. Navigation Menu (A) The left part of the screen is dedicated to: • the navigation within the 3 sections of the DORA - Major Incident Reports notification form, that is: • o “Initial notification”, o “Intermediate report”, o “Final report” “CSSF 24/847 incident reports” or “DORA - Major Incident Reports”: this allows the Supervised Entity to return to the main dashboard and access the ongoing or completed notifications. 2.4.2.1.2. The information to be filled in by the Supervised Entity (B) The main part of the notification page devoted to form information, identified in the figure above as “B”, is the part of the screen where the metadata relating to the incident notification is displayed. This part is made up of the following sub-sections: • B1: “Form”, • B2: “Documents”, and • B3: “Comments” The “Form” part contains the questions related to the incident, to be answered by the Supervised Entity. This part exists in the 3 sections of the notification form. Explanatory notes are available by hovering over the “question mark” symbol to provide further explanations regarding the information to be provided by the Supervised Entity. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 20/44 2.4.2.1.3. Information and validation (C) The “Information & validation” section of the screen covers the following: • “Report information”: Provides general information of the Supervised Entity such as the Supervised Entity’s name, and code, the status of the notification, the creation date and the user who created the notification. • “Inconsistencies report”: Displays the potential missing information and inconsistencies to be resolved by the Supervised Entity before submitting the notification to the CSSF. • “Actions”: These are action buttons that represent actions that can be taken by the user at any given point in time. Actions could be for example Submit, Delete or Modify. When actions are “greyed”, the action button cannot be clicked. This may be because the report is incomplete, or the incident has already been closed on the CSSF side. 2.4.2.2. Filling in the first draft of a notification Once a new incident notification form is created, the user can fill in the information requested. The user can complete and submit the relevant sections of the notification form. Each section of a notification form can be accessed by clicking on the corresponding name of the section in the navigation Menu. - Initial notification: This section gathers the general information about the incident. - Intermediate report: This second section provides a more detailed description of the incident, its consequences and the corrective measures that were taken to recover. - Final report: This third section provides information regarding the root cause analysis and the resolution of the incident. When submitting this information, the Supervised Entity shall review the other sections and update these, where appropriate. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 21/44 The user shall always save the information filled-in by clicking on the “Save” button at the bottom of the section prior to submitting any section of an incident notification. Any saved section will have the status “Draft” and will not yet be visible by the CSSF. The draft data already saved can be deleted any time before the information is submitted to the CSSF via the dedicated “Delete” action button. 2.4.2.3. Deletion of a draft notification A notification at status “Draft” can be deleted by the Supervised Entity by clicking on the “Delete” action button in the “Information & validation” section. Any deleted notification cannot be restored and shall be started over. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 22/44 2.4.2.4. Submission of a draft notification A notification can be submitted by clicking the “Submit” action button in the “Information & validation” section. The system automatically prevents the user from submitting any incomplete notification form to the CSSF. In such case, the system will display a list of the missing data at the top of the form, as well as in the “Inconsistencies report” in the right section. Once the form is filled-in with the mandatory information and the changes are saved, the “Submit” button will be enabled. When clicking on the “Submit” button, a confirmation window will pop up for the user to confirm the requested action. The user will have to confirm this action for the notification to be submitted to the CSSF. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 23/44 Once confirmed, the status of this submitted section of the notification will change to “Submitted” and its respective submission date will be automatically displayed in the “Report information” section, as well as in the dashboard. A dedicated reference will also be automatically assigned to this submitted notification. Unlike the status, the filing reference is unique for the 3 sections of an incident notification. Important: The section “Initial information” or “Initial notification” of a notification shall be submitted first, followed by the section “Incident cause, classification and impact” or “Intermediate report”, and lastly the section “Root cause, follow up and additional information” or “Final report. 2.4.3. Modification of a submitted notification If the Supervised Entity has updates to an incident report already submitted, an updated version of the form may be submitted. In this case, the user shall click on the action “Modify”, that is only available at status “Submitted”. A new information “Last submission date” is then displayed in the “Report information” for the user to easily differentiate a new form from an update of an already submitted one. For any modification of an already submitted form, the user must complete the section “Summary of changes made to previous report”. A modified form reverts to the status “Draft” and must be saved and submitted again via the “Submit” action, for the CSSF to receive the updated information. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 24/44 Any new ongoing version of a form can be deleted via the “Delete” action, which, if confirmed via the usual popup window, brings the user back to its previous submitted version. Important: An incident notification with the status “Closed” can no longer be modified. New document(
34. s)or comment(
35. s)can however still be added and submitted. 2.4.4. Reclassification of an incident In case the incident no longer fulfils the criteria to be considered as major, the user can reclassify the incident notification in the system. The incident shall then be reclassified as minor by ticking the dedicated box at the top of the “Initial information” or “Initial notification” section of the notification form. Supervised entities must provide the date and an explanation of the reasons for this reclassification. This option is only available after the initial submission of the notification form. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 25/44 2.4.5. Addition of document(
36. s)to the notification form The “Documents” part allows the user to attach document(
37. s)to its notification where applicable. To add a document, follow the steps below: 1. Click on the “Add” button. 2. A new window will open allowing the user to upload a new document. Note: only pdf extension is authorized. The document is then uploaded and attached to the dedicated section with status “Draft” and can be downloaded or deleted by the user. Document(
38. s)attached to a specific section of an incident notification are submitted to the CSSF together with the corresponding section of the “Form”, via the action “Submit”. Document(
39. s)added to closed files shall be submitted individually. The deletion action remains available until the section is submitted to the CSSF, changing the status of the document to “Active”. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 26/44 2.4.6. Exchange of comment(
40. s)with the CSSF The “Comments” part allows the CSSF and supervised entities to exchange comments about the information submitted in the form. New comments can be created by clicking on “Add”. A new window will be displayed, allowing the user to write a text. The user shall then click on the “Save” button to save the entered text. The comment will then be displayed in the dedicated “Comments” section and can be respectively “Edited”, “Published to the CSSF”, or “Deleted” via the action buttons. Important: The “Save” button will only save a draft version of a comment but will not send the comment to the CSSF. To send a comment to the CSSF, the user shall click on the “Publish” icon and confirm the action in the popup window. Once the comment is published to the CSSF it can no longer be edited or deleted. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 27/44 The comments published by the CSSF to the Supervised Entity will be visible in the same section. Those comments have the CSSF logo before the name of the CSSF agent who published it. Comments can be added and published any time after the initial submission of the “Initial information” or “Initial notification” section. 2.5. DORA - Significant Cyber Threat Reports The following actions are possible: • Creation of a new notification • Modification of a submitted notification • Addition of document(
41. s)to the notification form • Exchange of comment(
42. s)with the CSSF 2.5.1. Dashboard of DORA - Significant Cyber Threat Reports notifications When connecting to the modules, the main part of the page is a dashboard providing a general view of all the notifications created by the Supervised Entity, with usual filtering and sorting functionalities. The dashboard for DORA - Significant Cyber Threat Reports contains the following columns: - Reference: Reference of the major ICT-related incident notification, automatically assigned once a notification is submitted, - Entity code: CSSF code of the Supervised Entity, - Status: Status of the form. The value of each status can be either “Draft”, “Submitted” or “Closed”, - Submission Date: Date of the form submission, - Origin: The submission channel through which the incident was submitted to the CSSF. The value will be either “eDesk” or “S3”, - Action(s): The Supervised Entity can “open” the notification form by clicking on the “folder” icon. The entity can also double-click on a given line to consult a form. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 28/44 Above the dashboard, a top banner contains several links and useful information: • a link to the global eDesk dashboard (by clicking on the eDesk logo or “Home”), • a link to the procedures accessible by the connected Supervised Entity user (by clicking on “Procedures”), • the name of the user connected and corresponding Supervised Entity name (not visible in the above illustration), with a small arrow on the right which can be used to access: o the “User profile” by clicking “Manage profile”, o the “Entity management” (available only for the advanced users), and o the Logout functionality. Below the top banner is a button labelled “CREATE A NEW SIGNIFICANT CYBER THREAT REPORT” which allows the Supervised Entity to create a new incident notification. Further details are provided in the next section. 2.5.2. Creation of a new notification To create a new Significant Cyber Threat report, the user shall click on the “CREATE A NEW SIGNIFICANT CYBER THREAT REPORT” button on the dashboard page. Once the button is clicked, a new incident notification page opens. To ease the navigation within the form, sub-sections can be reduced by clicking on the greyed out sub-section’s title. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 29/44 2.5.2.1. 2.5.2.1.1. Description of the notification form structure Navigation Menu (A) The left part of the screen is dedicated to: • the navigation within the notification form, • “DORA - Significant Cyber Threat Reports”: this allows the Supervised Entity to return to the main dashboard and access the ongoing or completed notifications. 2.5.2.1.2. The information to be filled in by the Supervised Entity (B) The main part of the notification page devoted to form information, identified in the figure above as “B”, is the part of the screen where the metadata relating to the incident notification is displayed. This part is made up of the following sub-sections: • B1: “Form”, • B2: “Documents”, and • B3: “Comments” The “Form” (B1) part contains the questions related to the incident, to be answered by the Supervised Entity. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 30/44 Explanatory notes are available by hovering over the “question mark” symbol to provide further explanations regarding the information to be provided by the Supervised Entity. 2.5.2.1.3. Information and validation (C) The “Information & validation” section of the screen covers the following: • “Report information”: Provides general information of the Supervised Entity such as the Supervised Entity’s name, and code, the status of the notification, the creation date and the user who created the notification. • “Inconsistencies report”: Displays the potential missing information and inconsistencies to be resolved by the Supervised Entity before submitting the notification to the CSSF. • “Actions”: These are action buttons that represent actions that can be taken by the user at any given point in time. Actions could be for example Submit, Delete or Modify. When actions are “greyed”, the action button cannot be clicked. This may be because the report is incomplete, or the incident has already been closed on the side of the CSSF. 2.5.2.2. Filling in the first draft of a notification Once a new Significant Cyber Threat report form is created, the user can fill in the information requested. The user can complete and submit the relevant sections of the notification form. The user shall always save the information filled-in by clicking on the “Save” button at the bottom of the section prior to submitting any section of an incident notification. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 31/44 Any saved section will have the status “Draft” and will not yet be visible by the CSSF. The draft data already saved can be deleted any time before the information is submitted to the CSSF via the dedicated “Delete” action button. 2.5.2.3. Deletion of a draft notification A notification at status “Draft” can be deleted by the Supervised Entity by clicking on the “Delete” action button in the “Information & validation” section. Any deleted notification cannot be restored and shall be started over. 2.5.2.4. Submission of a draft notification A notification can be submitted by clicking the “Submit” action button in the “Information & validation” section. The system automatically prevents the user from submitting any incomplete notification form to the CSSF. In such case, the system will display a list of the missing data at the top of the form, as well as in the “Inconsistencies report” in the right section. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 32/44 Once the form is filled-in with the mandatory information and the changes are saved, the “Submit” button will be enabled. When clicking on the “Submit” button, a confirmation window will pop up for the user to confirm the requested action. The user will have to confirm this action for the notification to be submitted to the CSSF. Once confirmed, the status of this section of the notification will change to “Submitted” and its submission date will be automatically displayed in the “Report information” section, as well as in the dashboard. A dedicated reference will also be automatically assigned to this submitted notification. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 33/44 2.5.3. Modification of a submitted notification If the Supervised Entity has updates to a Significant Cyber Threat report already submitted, an updated version of the form may be submitted. In this case, the user shall click on the action “Modify”, that is only available at status “Submitted”. A new information “Last submission date” is then displayed in the “Report information” for the user to easily differentiate a new form from an update of an already submitted one. For any modification of an already submitted form, the user must complete the section “Summary of changes made to previous report”. A modified form reverts to the status “Draft” and must be saved and submitted again via the “Submit” action, for the CSSF to receive the updated information. Any new ongoing version of a form can be deleted via the “Delete” action, which, if confirmed via the usual popup window, brings the user back to its previous submitted version. Important: A Significant Cyber Threat report with the status “Closed” can no longer be modified. New document(
43. s)or comment(
44. s)can however still be added and submitted. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 34/44 2.5.4. Addition of document(
45. s)to the notification form The “Documents” part allows the user to attach document(
46. s)to its notification where applicable. To add a document, follow the steps below: 1. Click on the “Add” button. 2. A new window will open allowing the user to upload a new document. Note: only pdf extension is authorized. The document is then uploaded and attached to the dedicated section with status “Draft” and can be downloaded or deleted by the user. Document(
47. s)attached to a specific section of an incident notification are submitted to the CSSF together with the corresponding section of the “Form”, via the action “Submit”. Document(
48. s)added to closed files shall be submitted individually. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 35/44 The deletion action remains available until the section is submitted to the CSSF, changing the status of the document to “Active”. 2.5.5. Exchange of comment(
49. s)with the CSSF The “Comments” part allows the CSSF and supervised entities to exchange comments about the information submitted in the form. New comments can be created by clicking on “Add”. A new window will be displayed, allowing the user to write a text. The user shall then click on the “Save” button to save the entered text. The comment will then be displayed in the dedicated “Comments” section and can be respectively “Edited”, “Published to the CSSF”, or “Deleted” via the action buttons. CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 36/44 Important: The “Save” button will only save a draft version of a comment but will not send the comment to the CSSF. To send a comment to the CSSF, the user shall click on the “Publish” icon and confirm the action in the popup window. Once the comment is published to the CSSF it can no longer be edited or deleted. The comments published by the CSSF to the Supervised Entity will be visible in the same section. Those comments have the CSSF logo before the name of the CSSF agent who published it. Comments can be added and published any time after the initial submission of the Significant Cyber Threat report. 3. Notification via the S3 solution 3.1Overview of the S3 solution and prerequisite S3 or “simple storage service” is the object storage protocol (through a web service interface) used by the CSSF for the file exchange through a S3 compatible transfer client. S3 stores data as objects within buckets. In S3, Supervised Entities will use the following folders: • The “submission” folder to upload reporting files; • The “feedback” folder to retrieve feedback. Depending on the transfer client used, the “submission” folder may have to be manually created. Important: To submit data using S3, Supervised Entities must enrol themselves using the “IT Expert” role. Please refer to the S3 User Guide “Methods of transmitting reports via S3 Application Programming Interface - Technical guidance” available here for detailed explanations on how S3 works and the enrolment process: https://www.cssf.lu/en/methods-of-transmitting-reports-via-api/ CSSF 24/847 MAJOR ICT-RELATED INCIDENT NOTIFICATION, DORA MAJOR ICT-RELATED INCIDENT AND SIGNIFICANT CYBER THREATS REPORTING - USER GUIDE Publication date 17/01/2025 37/44 3.2Reporting file 3.2.1 Reporting format and naming convention Data concerning the 3 forms (CSSF 24/847 incident reports, DORA – Major incident reports and DORA – Significant cyber threat reports) for Supervised Entities shall be reported in JavaScript Object Notation (JSON) format file with the extension “.json”. The respective JSON schemas are available here: • CSSF 24/847 Incident Reports: https://edesk.apps.cssf.lu/edesk- dashboard/docs/epi/jsonschema/v1_0_0/mictir-input-jsonschema-v1_0_0 • DORA - Major Incident Reports: https://edesk.apps.cssf.lu/edesk- dashboard/docs/epi/jsonschema/v1_0_0/dictir-input-jsonschema-v1_0_0 DORA – Significant Cyber Threat Report: https://edesk.apps.cssf.lu/edesk- dashboard/docs/epi/jsonschema/v1_0_0/ctr-input-jsonschema-v1_0_0 The mandatory naming convention for JSON files is UUID format (universally unique identifier). The files shall be named: • MICTIR-ENNNNNNNN-YYYY-MM-DD.json for CSSF 24/847 Incident Reports • DICTIR-ENNNNNNNN-YYYY-MM-DD.json for DORA – Major Incident Reports • CTR-ENNNNNNNN-YYYY-MM-DD.json for DORA – Significant Cyber Threat Reports with each component of the name described in the below table: Code TYPE Meaning Structure Reporting type Char(N) Authorised value ‘MICTIR’ for CSSF 24/847 Incident Reports ‘DICTIR’ for DORA – Major Incident Reports ‘CTR’ for DORA – Significant Cyber Threat Reports - Separator Char