CySec Requires Information on Cybersecurity Incidents in Light of Rampant Cyber-Attacks

The Cyprus Securities and Exchange Commission ('CySEC') wishes herein to collect information on any cybersecurity incidents, in order to further assess cybersecurity risks and take any required actions. 

The risk of cyber-attacks is becoming more common and probable in recent years, due to various factors and developments. Such factors/developments include the increased appetite for investments in virtual products, the increase in the number of digitalized processes due to the covid-19 pandemic, the reliance on group IT arrangements for investment firms that are part of a large group and the geopolitical situation in Ukraine.

Taking the above into consideration, and in order to support the monitoring and mitigation of this risk, CySEC wishes to collect information on any cybersecurity incident affecting Regulated Entities, in order to assess potential related targets in the market and take preventative/mitigating measures. Additionally, the collection of information will allow CySEC to collectively assess whether and how cyber risk is evolving in the market.

The information submitted by Regulated Entities will be exchanged with other EU National Competent Authorities ('NCAs') and the European Securities and Markets Authority ('ESMA') on an anonymous basis, so that other NCAs can identify potential related targets in their markets.

Therefore, Regulated Entities are requested to report to CySEC, as of the date of this circular, any cybersecurity incidents (both successful and unsuccessful attacks) which could generate disruptions. The characteristics of these incidents should be:

• Abnormal/extraordinary from the Regulated Entity's scope, volume and level of sophistication.

• ​Using new means/techniques.

For this reporting, Regulated Entities should file the relevant reports promptly, as soon as they become aware of these incidents,