The Cyprus Securities and Exchange Commission (CySEC) has issued Circular C799, providing further guidance to regulated entities on the submission of the reporting template under the Joint Guidelines of the European Supervisory Authorities (ESAs) on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under DORA (Regulation (EU) 2022/2554).
Regulated entities that have experienced major ICT-related incidents are required to estimate and report the associated aggregated annual costs and losses to CySEC in accordance with the Joint Guidelines. Entities must select either the completed calendar year or accounting year as their reference period, clearly state this in the report, and apply the selected approach consistently going forward.
Reports are generally due by 30 June each year following the relevant reference year. Importantly, for major ICT-related incidents incurred in 2025, the reporting deadline is 30 September 2026. Submissions must be made exclusively through the CySEC Portal under “Estimation of Aggregated Annual Costs and Losses Caused by Major ICT-Related Incidents”.
Regulated entities should review the Joint Guidelines and ensure their ICT incident management and reporting processes are aligned with these requirements.
