Article 14 – Significant incidents with regard to trust service providers

With regard to trust service providers, an incident shall be considered significant under Article 3 where it fulfils one or more of the following criteria:

(a) a trust service, or a part of it, is completely unavailable for more than 10 minutes;

(b) a trust service, or a part of it, is unavailable to users, or relying parties, for more than one hour calculated on a calendar week basis;

(c) more than 1 % of the customers of the trust service in the Union are impacted by large delays in response time of the trust service;

(d) physical access to one or more of the areas where network and information systems are located and to which access is restricted to trusted personnel of the trust service provider, or the protection of such physical access, is compromised;

(e) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of the trust service is compromised with an impact on more than 1 % of the customers of the trust service in the Union.