CyberSec Update #41 – Significant Incident Thresholds | KWKR
Changes to the thresholds for classifying incidents as significant are coming
At the beginning of September, a draft regulation of the Council of Ministers was published. It will define the thresholds for classifying an incident as significant across individual sectors and subsectors specified in the annexes to the Polish Act on the National Cybersecurity System (uKSC).
Which sectors will the significant incident thresholds apply to?
The draft regulation sets out thresholds for classifying incidents as significant in sectors including:
- energy,
- transport,
- healthcare,
- digital infrastructure,
- waste management,
- manufacturing.
The exact number of entities that will be affected by the draft regulation is not yet known. The self-identification process for essential and important entities in the KSC Register continued until 3 October.
Reporting significant incidents to CSIRTs
It should be recalled that the uKSC requires essential and important entities to report significant incidents. Reports must be submitted via the ICT system referred to in Article 46 of the Act, known as the S46 System, to the competent sectoral CSIRT.
The deadline for submitting a report is 72 hours from the moment the incident is detected.
Thresholds have already been established for some entities
Importantly, significant incident thresholds have already been established for certain essential and important entities under Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, which lays down rules for the application of Directive (EU) 2022/2555.
This applies, among others, to certain entities in the “Digital Infrastructure” sector, including internet exchange point providers, entities providing domain name registration services and electronic communications undertakings.
Banking and financial market infrastructures are excluded from the draft regulation
The draft national regulation does not set thresholds for classifying incidents as significant in the banking and financial market infrastructures sectors.
The relevant legal act in this area remains Commission Delegated Regulation (EU) 2024/1772, which supplements the regulation commonly known as DORA.
How will an incident be assessed as significant?
Under the proposed rules, when assessing an incident, essential and important entities will consider threshold values relating to:
- the number of users affected by a disruption to the provision of a service,
- the duration of the incident’s impact on the service provided,
- the geographical scope of the area affected by the incident,
- other factors specific to a particular subsector.
Financial losses exceeding PLN 2 million
Importantly, where an incident results in financial losses, it will be classified as a significant incident if the financial loss exceeds PLN 2,000,000.
When will the new rules enter into force?
The draft regulation does not provide for a transitional period. If adopted, the new rules will enter into force 14 days after the regulation is published.
