Intesa-Sanpaolo - Cyber Incident Reporting - Practical Issues and Recommendations

Sep 12, 2026

The text addresses challenges to achieving greater convergence in cyber incident reporting (CIR), focusing on practical issues in collecting and using incident information across borders and sectors. It highlights fragmentation caused by multiple regulations and differing reporting thresholds, as well as overlaps and redundancy created by new requirements at national, European, and international levels. It also discusses how bidirectional information flows and clearer inter-authority communication could make incident reporting workflows more effective and move toward a proactive framework. The recommendations propose harmonization via a centralised hub approach.

LanguageEnglish

CategoryLetters

FormatPDF

Pages4

Reading Time2 min

AccessFree to download

Challenges to achieving greater convergence in CIR

Cross-border and cross-sectoral issues

Incident reporting workflows effectiveness

Culture of timely reporting and early assessment challenges

Recommendations

Challenges to achieving greater convergence in CIR (Section 2) 1. Is the emphasis on practical issues to collecting and using cyber incident information consistent with your experience? Does your institution want to provide any additional evidence for the FSB to consider from your experience? Yes, the emphasis on practical issues to collecting and using cyber incident information is consistent with our experience. Concerning the “Cross-border and cross-sectoral issues”, Intesa Sanpaolo considers that beyond the financial sector, the need for incident reporting harmonization in a cross-industries & cross-borders perspective is a strong and pressing issue. We note a lack of common criteria in the various regulations and thresholds for reporting incidents. In fact, as reported by the paper, the calibration of reporting criteria is often specific to each financial authority, but there is a need of common criteria and thresholds involving different incident reporting regulations. When looking at cross-borders interaction the approach is twofold. In a bottom-up perspective , each private entity has to assess which are the local jurisdictions applicable to its geographic presence. From a top-down perspective, in most cases legislators have identified a need for cross-border cooperation. However, this relies upon the communication among National Competent Authorities, and generally the legislations foresee a central entity at EU level that shall be informed by the National Competent Authority. Intesa Sanpaolo highlights two aspects that should be considered regarding the Incident Reporting workflows to make them more effective, and to move towards a more proactive incident reporting framework, namely: • It shall be appropriate to reconsider the workflow to introduce a bi-directional information flow. • It is unclear how the different Supervisory Authorities do communicate with each other to be able to leverage to the greatest extent the sharing of relevant information. Banks are often subject to multiple regulations and consequently to multiple reporting requirements for one incident with consequent fragmentation, multiple reporting, different thresholds , excessive effort for reporting to the various authorities involved. The latest regulatory developments have introduced new requirements in data security, info-sharing, incident reporting and crisis management. The frameworks for Incident reporting, arising from these developments , imply the involvement of multiple authorities at National, European, and international level, applying different procedures and templates, creating possible overlaps and redundancy in the process of information reporting. We hope that the introduction of the DORA-Digital Operational Resilience Act will facilitate reporting obligations since one of its goals is to facilitate and harmonize incident reporting and the incident management landscape. As regard the practical issues “Culture of timely reporting” and “Early assessment challenges”, Intesa Sanpaolo believes that the mandatory incident reporting frameworks indeed require very often avery tight timeline for the incident notifications. This means that the Incident Management Team must take care of the incident management reporting in parallel with the incident management and the recovery procedure. Recommendations (Section 3) 2. Can you provide examples of how some of the practical issues with collecting and using cyber incident information have been addressed at your institution? We want to underline some main challenges that we see in our experience: First, there is a lack of harmonization. In particular: • Financial institutions are subject to multiple regulations and to multiple reporting requirements for one incident with consequent fragmentation, multiple reporting, different thresholds, excessive effort for reporting to the various authorities involved. • The latest regulatory evolutions have introduced new requ

FAQs

Why does Intesa Sanpaolo see a lack of convergence in cyber incident reporting across jurisdictions?

Financial institutions face multiple regulations and multiple reporting requirements for the same incident, with different thresholds and fragmented efforts. This also leads to overlaps and redundancy when new incident reporting frameworks require involvement of several authorities at national, European, and international levels.

What cross-border interaction approach does Intesa Sanpaolo describe?

Intesa Sanpaolo describes a twofold approach: a bottom-up assessment by each private entity to determine applicable local jurisdictions, and a top-down perspective where legislators identify a need for cross-border cooperation that depends on communication among national competent authorities and EU-level central information.

What recommendations are proposed to promote greater convergence in CIR?

Intesa Sanpaolo suggests leveraging a centralised Hub for mandatory incident reporting, supported by a feasibility study by European supervisory authorities under DORA. It also proposes a two-step adoption path so the structure evolves gradually toward higher efficiency.

Sep 12, 2026

Upload by Nguyễn Văn Học