5. Financial entities should estimate the aggregate annual costs and losses of major ICT-related incidents by aggregating the costs and losses for major ICT-related incidents that fall within the reference period. The reference period should be the completed accounting year for which the competent authority requested the estimation. Financial entities should not include costs and losses related to those incidents that fall before or after that reference period.
6. Financial entities should include in the estimation all ICT-related incidents that were classified as major in accordance with the RTS on incident classification and
(a) for which the financial entity has submitted a final report in accordance with Article 19(4)(c) Regulation (EU) 2022/2554 in the relevant accounting year, or
(b) any incident for which the financial entity submitted in previous accounting years a final report in accordance with Article 19(4)(c) of Regulation (EU) 2022/2554 that had a quantifiable financial im
…