Question ID: 2781 - DORA010
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: ICT-related incidents (DORA)
Article: Art.22(1)
Status: Rejected
Date of submission: 04 Sep 2023
Question
We would like clarity on what are the different roles and responsibilities between national Computer Security Incident Response Teams (CSIRTs) - as Competent Authorities for Directive (EU) 2022/2555 ('NIS2')- and National Competent Authorities (NCAs) - as Competent Authorities for Regulation (EU) 2022/2554 ('DORA'). Based on Art.22(1) of DORA and Art.23(5) of NIS2 - and considering the fact that DORA is lex specialis (vide recital (23) of NIS2) vis-a-vis NIS2 and, therefore, Art.23(5) of NIS2 would prima facie not apply - we would like clarification on who is responsible (National CSIRT or NCA) for immediate technical guidance/input to financial entities reporting a Major ICT-related Incidents, Significant Cyber Threats, and/or Major Operational or Security Payment-related Incidents under DORA in cases where the discretions referred to in Art. 19(1) subpara. 6 and Art.19(2) subpara. 3 of DORA is not taken up the Member State (i.e., in cases where Financial Entities are not mandated to send incident reports to both the National CSIRT and NCA).
Background of the question
Art.22(1) of DORA provides: "Without prejudice to the technical input, advice or remedies and subsequent follow-up which may be provided, where applicable, in accordance with national law, by the CSIRTs under Directive (EU) 2022/2555 the competent authority shall, upon receipt of the initial notification and of each report as referred to in Article 19(4), acknowledge receipt and may, where feasible, provide in a timely manner relevant and proportionate feedback or high-level guidance to the financial entity, in particular by making available any relevant anonymised information and intelligence on similar threats, and may discuss remedies applied at the level of the financial entity and ways to minimise and mitigate adverse impact across the financial sector (...)" Art. 23(5) of NIS2 provides: "5. The CSIRT or the competent authority shall provide, without undue delay and where possible within 24 hours of receiving the early warning referred to in paragraph 4, point (a), a response to the notifying entity, including initial feedback on the significant incident and, upon request of the entity, guidance or operational advice on the implementation of possible mitigation measures. Where the CSIRT is not the initial recipient of the notification referred to in paragraph 1, the guidance shall be provided by the competent authority in cooperation with the CSIRT. The CSIRT shall provide additional technical support if the entity concerned so requests. Where the significant incident is suspected to be of criminal nature, the CSIRT or the competent authority shall also provide guidance on reporting the significant incident to law enforcement authorities."
EIOPA answer
Question is rejected because it is a request for interpretation of NIS2 provisions, for which we are not competent authority.