On recognising a computer system failure or a cybersecurity incident, the institution reports the fact to the authority immediately and then reports the cause, damage, response and improvement measures; under the amendment published 18 September 2026 and applying from 1 October 2026, these reports use the government's common forms agreed among ministries on 28 May 2025 (revised 15 September 2026): the DDoS form, the ransomware form and the new form for other cyberattacks, with the former failure report form allowed until the end of March 2027 for institutions not designated as specified essential infrastructure operators; a report on the ransomware or other-attack form can double as the personal data breach report. It reports again on recovery and on identifying the cause, and within one month with the current status if not yet resolved. Reportable failures are those delaying or stopping deposit withdrawals, exchange and other settlement functions, affecting funding or financial position, or similar, unless other systems promptly take over; even without a failure, an announced or detected attack likely to affect customers or operations is reportable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.