[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-246767-105":53,"doc-detail-246767-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","intesa-sanpaolo-cyber-incident-reporting-practical-issues-and-recommendations","Intesa-Sanpaolo - Cyber Incident Reporting - Practical Issues and Recommendations","","The text addresses challenges to achieving greater convergence in cyber incident reporting (CIR), focusing on practical issues in collecting and using incident information across borders and sectors. It highlights fragmentation caused by multiple regulations and differing reporting thresholds, as well as overlaps and redundancy created by new requirements at national, European, and international levels. It also discusses how bidirectional information flows and clearer inter-authority communication could make incident reporting workflows more effective and move toward a proactive framework. The recommendations propose harmonization via a centralised hub approach.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":41,"@type":70,"position":76},"https://docshare.wps.com/template/letters/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/intesa-sanpaolo-cyber-incident-reporting-practical-issues-and-recommendations/246767/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/intesa-sanpaolo-cyber-incident-reporting-practical-issues-and-recommendations/246767.png","ImageObject",442,249,{"name":88,"@type":89},"Nguyễn Văn Học","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-09-12",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Why does Intesa Sanpaolo see a lack of convergence in cyber incident reporting across jurisdictions?","Question",{"text":108,"@type":109},"Financial institutions face multiple regulations and multiple reporting requirements for the same incident, with different thresholds and fragmented efforts. This also leads to overlaps and redundancy when new incident reporting frameworks require involvement of several authorities at national, European, and international levels.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What cross-border interaction approach does Intesa Sanpaolo describe?",{"text":113,"@type":109},"Intesa Sanpaolo describes a twofold approach: a bottom-up assessment by each private entity to determine applicable local jurisdictions, and a top-down perspective where legislators identify a need for cross-border cooperation that depends on communication among national competent authorities and EU-level central information.",{"name":115,"@type":106,"acceptedAnswer":116},"What recommendations are proposed to promote greater convergence in CIR?",{"text":117,"@type":109},"Intesa Sanpaolo suggests leveraging a centralised Hub for mandatory incident reporting, supported by a feasibility study by European supervisory authorities under DORA. It also proposes a two-step adoption path so the structure evolves gradually toward higher efficiency.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},246767,1790177615,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":40,"category_name":41,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":79,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":73},1374402739827,"https://ap-avatar.wpscdn.com/avatar/14000c97e7351f1a627?x-image-process=image/resize,m_fixed,w_180,h_180&k=1787885694763230660","Challenges to achieving greater convergence in CIR (Section 2)  \n1. Is the emphasis on practical issues to collecting and using cyber incident information consistent with your experience? Does your institution want to provide any additional evidence for the FSB to consider from your experience?  \nYes, the emphasis on practical issues to collecting and using cyber incident information is consistent with our experience.  \nConcerning the “Cross-border and cross-sectoral issues”, Intesa Sanpaolo considers that beyond the financial sector, the need for incident reporting harmonization in a cross-industries & cross-borders perspective is a strong and pressing issue. We note a lack of common criteria in the various regulations and thresholds for reporting incidents. In fact, as reported by the paper, the calibration of reporting criteria is often specific to each financial authority, but there is a need of common criteria and thresholds involving different incident reporting regulations.  \nWhen looking at cross-borders interaction the approach is twofold. In a bottom-up perspective , each private entity has to assess which are the local jurisdictions applicable to its geographic presence. From a top-down perspective, in most cases legislators have identified a need for cross-border cooperation. However, this relies upon the communication among National Competent Authorities, and generally the legislations foresee a central entity at EU level that shall be informed by the National Competent Authority.  \nIntesa Sanpaolo highlights two aspects that should be considered regarding the Incident Reporting workflows to make them more effective, and to move towards a more proactive incident reporting framework, namely:  \n• It shall be appropriate to reconsider the workflow to introduce a bi-directional information flow.  \n• It is unclear how the different Supervisory Authorities do communicate with each other to be able to leverage to the greatest extent the sharing of relevant information.  \nBanks are often subject to multiple regulations and consequently to multiple reporting requirements for one incident with consequent fragmentation, multiple reporting, different thresholds , excessive effort for reporting to the various authorities involved.  \nThe latest regulatory developments have introduced new requirements in data security, info-sharing, incident reporting and crisis management. The frameworks for Incident reporting, arising from these developments , imply the involvement of multiple authorities at National, European, and international level, applying different procedures and templates, creating possible overlaps and redundancy in the process of information reporting.  \nWe hope that the introduction of the DORA-Digital Operational Resilience Act will facilitate reporting obligations since one of its goals is to facilitate and harmonize incident reporting and the incident management landscape.  \nAs regard the practical issues “Culture of timely reporting” and “Early assessment challenges”, Intesa Sanpaolo believes that the mandatory incident reporting frameworks indeed require very often avery tight timeline for the incident notifications. This means that the Incident Management Team must take care of the incident management reporting in parallel with the incident management and the recovery procedure.  \nRecommendations (Section 3)  \n2. Can you provide examples of how some of the practical issues with collecting and using cyber incident information have been addressed at your institution?  \nWe want to underline some main challenges that we see in our experience:  \nFirst, there is a lack of harmonization. In particular:  \n• Financial institutions are subject to multiple regulations and to multiple reporting requirements for one incident with consequent fragmentation, multiple reporting, different thresholds, excessive effort for reporting to the various authorities involved.  \n• The latest regulatory evolutions have introduced new requ","cbCaiffJuqA1RT3A","https://ap.wps.com/l/cbCaiffJuqA1RT3A","pdf",158786,"English","# Challenges to achieving greater convergence in CIR\n## Cross-border and cross-sectoral issues\n## Incident reporting workflows effectiveness\n## Culture of timely reporting and early assessment challenges\n# Recommendations","[{\"question\":\"Why does Intesa Sanpaolo see a lack of convergence in cyber incident reporting across jurisdictions?\",\"answer\":\"Financial institutions face multiple regulations and multiple reporting requirements for the same incident, with different thresholds and fragmented efforts. This also leads to overlaps and redundancy when new incident reporting frameworks require involvement of several authorities at national, European, and international levels.\"},{\"question\":\"What cross-border interaction approach does Intesa Sanpaolo describe?\",\"answer\":\"Intesa Sanpaolo describes a twofold approach: a bottom-up assessment by each private entity to determine applicable local jurisdictions, and a top-down perspective where legislators identify a need for cross-border cooperation that depends on communication among national competent authorities and EU-level central information.\"},{\"question\":\"What recommendations are proposed to promote greater convergence in CIR?\",\"answer\":\"Intesa Sanpaolo suggests leveraging a centralised Hub for mandatory incident reporting, supported by a feasibility study by European supervisory authorities under DORA. It also proposes a two-step adoption path so the structure evolves gradually toward higher efficiency.\"}]","Intesa-Sanpaolo - Cyber Incident Reporting - Practical Issues and Recommendations | PDF",1789238028]