Article 10 – Significant incidents with regard to managed service providers and managed security service providers

With regard to managed service providers and managed security service providers, an incident shall be considered significant under Article 3 where it fulfils one or more of the following criteria:

(a) one or more of the managed services or managed security services is completely unavailable for more than 10 minutes;

(b) for one or more of the managed services or managed security services provided, the customer service level agreement is not met for more than 5 % of the service users in the Union, or for more than 1 million of the service users in the Union, whichever number is smaller, for a duration of more than one hour;

(c) the availability of one or more of the managed or managed security services of a provider that has no customer service level agreement in place is impacted by the incident;

(d) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of the managed service or the managed security service is compromised as a result of a suspectedly malicious action

(e) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of the managed service or the managed security service, is compromised with an impact on more than 5 % of the managed service or the managed security service users in the Union.