FIDA Incident Response

FIDA incident response covers several incident categories: API outages and performance degradation affecting data access, unauthorized data access through compromised credentials or system errors, consent violations where data is shared without valid permission, data breaches under the GDPR with FIDA relevance, and violations of FIDA Scheme agreements.

Specific notification deadlines will be defined by the FIDA regulation and the respective FIDA Schemes. Reference points are the GDPR notification requirement of 72 hours for data breaches and DORA requirements for ICT-related incidents. FIDA is expected to introduce its own notification deadlines for data-access-specific incidents. ADVISORI supports setting up automated notification systems.

The build-out comprises four steps: First, defining incident categories and escalation levels specific to FIDA incidents. Second, implementing monitoring and detection systems for API anomalies, consent violations and data access patterns. Third, creating runbooks with clear instructions for each incident category. Fourth, training involved teams and conducting regular exercises.

During an acute incident, ADVISORI follows a structured process: Immediate containment by isolating affected API endpoints or blocking compromised access. Parallel assessment of damage scope and affected data. Regulatory notification to supervisory authorities within prescribed deadlines. Communication to affected customers and business partners. Subsequently, systematic root cause analysis and implementation of corrective measures.

Proactive monitoring is the core of effective FIDA incident response. Monitored are API availability and response times, unusual data access patterns and volume anomalies, consent status changes and expired permissions, security events such as failed authentication attempts, and compliance metrics such as SLA adherence and data quality.

DORA (Digital Operational Resilience Act) defines general requirements for digital operational resilience at financial institutions, including ICT incident management. FIDA adds data-access-specific requirements. An integrated approach avoids duplication: DORA incident response processes form the foundation, with FIDA-specific aspects such as consent violations and API data access incidents integrated as extensions.

Post-incident analysis covers complete reconstruction of the incident timeline, identification of root causes and contributing factors, assessment of response measure effectiveness, derivation of concrete improvement measures for technology, processes and training, documentation for supervisory authorities and internal governance, and updating runbooks and monitoring rules.