Article 93

Reporting of significant incidents

1. Union space operators shall report to the structure referred to in Article 34(4) of Regulation (EU) 2021/696 significant incidents affecting the Union-owned assets.

2. Without prejudice to paragraph 3, Union space operators shall report to the competent authorities referred to in Article 28(1) the significant incidents affecting the assets referred to in Article 5, first paragraph, point (21). The competent authorities referred to in Article 28(1) shall in turn transmit a summary of each reported incident to the Agency.

3. Where Union space operators qualify as essential or important entities pursuant to Annexes I or II of Directive (EU) 2022/2555, the reporting referred to in paragraph 2, shall be carried out through the CSIRTs, established pursuant to Article 10 (1) of Directive 2022/2555 or, where applicable, the competent authority, established pursuant to Article 8(1) of Directive 2022/2555, which shall, without delay, transmit all the relevant reported information to the competent authorities referred to in Article 28(1), including any technical support and feedback that such CSIRTs or authorities provided to space operators pursuant to Articles 23 of that Directive.

Where Union space operators have been identified as critical entities pursuant to Directive (EU) 2022/2557, Member States shall determine whether the reporting referred to in the first subparagraph shall be carried out by the Union space operators directly to the competent authorities referred to in Article 28(1), or to the authorities referred to in Article 15 of that Directive or by other means. The provisions of paragraph 7 shall in that case apply accordingly as regards the information to be transmitted.

4. For Union space operators qualifying as essential or important entities pursuant to Annexes I or II of Directive (EU) 2022/2555, or which are identified as critical entities pursuant to Directive (EU) 2022/2557, respectively, the reporting requirement referred to in paragraphs 2 and 3 shall be without prejudice to the reporting obligations provided for in Article 23 of Directive (EU) 2022/2555 or the notification obligations provided for in Article 15(1) and (2) of Directive (EU) 2022/2557, respectively.

5. Without prejudice to the technical input, advice, remedies and subsequent follow-up which may be provided, as applicable, in accordance with national law, by the CSIRTs, in accordance with Article 11 of Directive (EU) 2022/2555, competent authorities may provide feedback to Union space operators, by making available any relevant anonymised information on cyber threats and may discuss remedies or ways to minimise and mitigate potential adverse impact across borders.

6. An incident shall be considered significant if:

(a) it has caused or can cause a severe operational disruption of space activities carried out by Union space operators, or of services provided, or considerable financial loss for the Union space operators concerned;

(b) it has an impact on, or can impact, other natural or legal persons by causing considerable material or non-material damage.;

7. Union space operators shall submit to the Agency, as regards the requirement referred to in paragraph 1, and respectively to the competent authorities, as regards the requirement referred to in paragraph 2, the following information:

(a) without undue delay, and in any event within 12 hours of becoming aware of the significant incident, as regards the Union-owned assets, and within 24 hours for assets referred to in Article 5, first paragraph, point (21), respectively, an early warning which shall indicate whether the significant incident may have been caused by unlawful or malicious acts, or if it could have a cross-border impact.

(b) without undue delay, and in any event within 72 hours of becoming aware of the significant incident, a report, which shall update the information referred to in point (a), and shall provide an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise.

(c) upon the request of the competent authority, or as applicable, of the Agency, an intermediate report with relevant status updates.

(d) a final report, not later than 1 month after the submission of the report referred to in point (b), including the following:

(i) a detailed description of the significant incident, including its severity and impact;

(ii) the type of threat or the root cause that is likely to have triggered that significant incident;

(iii) the applied and ongoing mitigation measures;

(iv) as applicable, the cross-border impact of the significant incident.;

(e) if a significant incident is still ongoing at the time of the submission of the final report referred to in point (d), a progress report at that time, as well as a final report within 1 month from the date of the handling the significant incident. The Commission is empowered to adopt delegated acts, in accordance with Article 113, to supplement this Regulation, by specifying the criteria to determine what constitutes a severe operational disruption of space activities, or of services provided by a Union space operator, as referred to in paragraph 6, point (a), including the relevant materiality thresholds.

8. The Commission is empowered to adopt implementing acts, in accordance with the examination procedure referred to in Article 114(2), to specify in further detail the content of the information to be reported pursuant to paragraph 7, and to lay down the templates and procedures for the reporting of that information.

Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/article.php:8) in /var/www/html/script/loginauth.php on line 163