Incident notifications

Other criteria for significant incidents by entity type:

• DNS service providers

  With regard to DNS service providers, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • A recursive or authoritative domain name resolution service is completely unavailable for more than 30 minutes.
  • For a period of at least one hour, the average response time for DNS requests of a recursive or authoritative domain name resolution service exceeds 10 seconds.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the authoritative domain name resolution service has been compromised, except in cases where data concerning fewer than 1,000 domain names managed by the DNS service provider, representing no more than 1% of the total domain names managed by the provider, are incorrect due to misconfiguration.

• Top-level domain administrators

  With regard to top-level domain administrators, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • An authoritative domain name resolution service is completely unavailable.
  • For a period of at least one hour, the average response time for DNS requests of an authoritative domain name resolution service exceeds 10 seconds.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the technical operation of the top-level domain has been compromised.

• Providers of cloud computing services

  With regard to providers of cloud computing services, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:
  

  • A delivered cloud computing service is completely unavailable for more than 30 minutes.
  • The availability of a provider’s cloud computing service is limited for more than 5% of users in the Union or for more than 1 million users in the Union, whichever number is lower, for a period of at least one hour.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a cloud computing service has been compromised as a result of a suspected malicious act.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a cloud computing service has been compromised to an extent that affects more than 5% of users of the cloud computing service in the Union or more than 1 million users in the Union, whichever is lower.

   

• Providers of data center services

  With regard to providers of data center services, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • A data center service from a data center operated by the provider is completely unavailable.
  • The availability of a data center service from a data center operated by the provider is limited for a period of at least one hour.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a data center service has been compromised as a result of a suspected malicious act.
  • Physical access to a data center operated by the provider has been compromised

• Providers of content delivery networks

  With regard to providers of content delivery networks, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • A content delivery network is completely unavailable for more than 30 minutes.
  • The availability of a content delivery network is limited for more than 5% of users of the network in the Union or for more than 1 million users in the Union, whichever is lower, for a period of at least one hour.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a content delivery network has been compromised as a result of a suspected malicious act.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a content delivery network has been compromised to an extent that affects more than 5% of users of the network in the Union or more than 1 million users, whichever is lower.

• Providers of managed services and managed security services

  With regard to providers of managed services and managed security services, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • A managed service or managed security service is completely unavailable for more than 30 minutes.
  • The availability of a managed service or managed security service is limited for more than 5% of users of the service in the Union or for more than 1 million users in the Union, whichever is lower, for a period of at least one hour.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a managed service or managed security service has been compromised as a result of a suspected malicious act.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a managed service or managed security service has been compromised to an extent that affects more than 5% of users of the service in the Union or more than 1 million users, whichever is lower. 

• Providers of online marketplaces

  With regard to providers of online marketplaces, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • An online marketplace is completely unavailable for more than 5% of users in the Union or for more than 1 million users in the Union, whichever is lower.
  • More than 5% of users in the Union or more than 1 million users, whichever is lower, are affected by limited availability of the online marketplace.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the online marketplace has been compromised as a result of a suspected malicious act.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the online marketplace has been compromised to an extent that affects more than 5% of users in the Union or more than 1 million users, whichever is lower.

• Providers of online search engines

  With regard to providers of online search engines, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:

  • An online search engine is completely unavailable for more than 5% of users in the Union or for more than 1 million users in the Union, whichever is lower.
  • More than 5% of users in the Union or more than 1 million users, whichever is lower, are affected by limited availability of the online search engine.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the online search engine has been compromised as a result of a suspected malicious act.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the online search engine has been compromised to an extent that affects more than 5% of users in the Union or more than 1 million users, whichever is lower.

• Providers of social networking service platforms

  With regard to providers of social networking service platforms, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:
  
  

  • A social networking service platform is completely unavailable for more than 5% of users in the Union or for more than 1 million users in the Union, whichever is lower.
  • More than 5% of users in the Union or more than 1 million users, whichever is lower, are affected by limited availability of the social networking service platform.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the social networking service platform has been compromised as a result of a suspected malicious act.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of the social networking service platform has been compromised to an extent that affects more than 5% of users in the Union or more than 1 million users, whichever is lower.

• Trust service providers

  With regard to trust service providers, an incident is considered significant under Article 3(1)(g) when one or more of the following criteria are met:
  
  

  • A trust service is completely unavailable for more than 20 minutes.
  • A trust service is unavailable to users or relying parties for more than one hour, calculated on a calendar week basis.
  • More than 1% of users or relying parties in the Union, or more than 200,000 users or relying parties in the Union, whichever number is lower, are impacted by limited availability of a trust service.
  • Physical access to an area where network and information systems are located, and to which access is restricted to the trust service provider’s trusted personnel, or the protection of such physical access, has been compromised.
  • The integrity, confidentiality, or authenticity of data stored, transmitted, or processed in connection with the provision of a trust service has been compromised to an extent that affects more than 0.1% of users of the trust service or relying parties in the Union, or more than 100 users or relying parties in the Union, whichever is lower.