FRANCE Trends and Developments Contributed by: Martine Samuelian, Olivier Lyon Lynch and Hugues Vaysset, Jeantet
The notifying entities are mainly credit institutions (32% non-SI and 17% SI) and insurance companies (19%). The insurance sector is therefore the second largest category of entities to have reported major incidents since DORA came into force, reflecting significant exposure to ICT risks. More specifically, it was shown that notifications come from: • Insurance and reinsurance undertakings. • Insurance intermediaries, reinsurance intermediar- ies and ancillary insurance intermediaries (b) Types of incidents reported Although the data is not broken down specifically by sector, the types of incidents reported by all financial entities (including insurance companies) are mainly IT failures, with 28 cybersecurity incidents, 21 process failures, 14 system failures, 12 payment-related inci- dents and nine external events. The figure for cyber incidents is high due to one incident that affected sev- eral entities. (c) Third-party involvement In more than half of the cases, third parties were involved (significant impact of the Harvest incident), highlighting the importance of managing risks related to ICT service providers for the insurance sector. Regarding challenges (a) Notification deadlines An incident must be reported within a maximum of four hours after being classified as major, and within a maximum of 24 hours after detection. These deadlines are still rarely met. (b) Submission format The Json format and submissions on OneGate pose problems with “homemade” internal tools and a lack of anticipation regarding accreditations.
The ACPR and AMF have noted that certain manda- tory fields are not being filled in or are being filled in incorrectly. (c) Information register (RoI) 84% of entities submitted data to Onegate, but only 39% of them had their RoI processed at European level. Explanatory factors include: • A very tight schedule for all parties involved. • Unstable validation rules that were modified during the submission period by the competent authori- ties, as well as an unusually high volume of techni- cal support requests. • An unusual submission format that required a level of familiarisation that was sometimes under - estimated by submitters (low participation in the dry run exercise, low use of the test environment, failure to anticipate the extent of internal govern- ance required). Regarding the next steps for the insurance sector (a) Support in 2025 Support was provided to all financial entities in 2025, including numerous presentations to market partici- pants since October 2024, technical support respond- ing to more than 700 questions, the organisation of bilateral meetings when necessary, and the creation of an FAQ list that was updated several times. (b) Enhanced supervision from 2026 As of 2026, enhanced supervision will be put in place with the identification of control priorities based on the ESRs conducted by the control services, the con- clusions drawn from the analysis of responses to the cross-sectoral questionnaire on the implementation of DORA, the quality of the RoIs and the initial con- clusions drawn from horizontal analyses, as well as notifications of major incidents. This will include the launch of cross-sectoral and trans-sectoral analyses, as well as on-site inspections for the most at-risk entities.
173 CHAMBERS.COM
Powered by FlippingBook