--- Annex 1 - Incident category ---
1° Security breach: Incident identified by an unauthorized access and incident disclosure, hacking/IT incidents and the loss/theft of physical records and unencrypted devices.
2° Malicious code (malware): Software or firmware (a virus) intended to perform an unauthorized process that will have damaging effect on the confidentiality, integrity, or availability of an information system.
3° Improper / Inappropriate human behaviour: Incident identified by negligence, error, omission or non-compliance with safety rules.
4° Cyberattack: Incident identified by an unauthorized and malicious access to mainly affect the confidentiality, integrity or availability of information or technical infrastructure
5° Technological Dysfunction: Incident occurring from poor security configurations or technological infrastructure failures or applications that have an impact on information security.
6° Loss or theft of information: Incident identified by the loss or theft of information in paper or electronic form (ex.: USB stick, laptop)
--- Annex 2 - Levels of severity and characteristics ---
1. Low: Affects a sector of activity of the organization.
2. Moderate: Affects multiple sectors of activity of the organization.
3. High
° Significantly affects the quality of services indispensable to the population.
° Has a strong potential to harm the reputation of the organization.
° Affects activities specific to one or more other organizations
° Affects the respect of the fundamental rights of the people, the protection of their personal information and their privacy, without prejudicing the health, life or well-being of these people.
4. Critical (government wide)
° One or more services cannot be rendered to the population.
° Endangers the health, life or well-being of people.
° Affects the respect of the fundamental rights of the people, the protection of their personal information and their privacy, and, as a result, endanger health, life or the well-being of these people.
° Affects the reputation of the government, with or without media coverage.
