**Classification trigger**: Date of detection, not date of recovery - **Major incident criteria**: Defined in Commission Delegated Regulation (thresholds for affected users, duration, geographic spread, economic impact) - **Management body**: Must be "adequately trained" on ICT risk (Article 5)