{"text_format":"1","workbook":"xlsx","n_sheets":13,"sheets":["Introduction DORA","Overall results","Task Manager ","ICT Risk Management","ICT-related incident management","Testing","Sheet6","Third Party Risk Mangement","Questionnaire","Do not Touch","Tasks","Sheet2","Sheet7"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":7,"comments":5,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction DORA","index":0,"n_rows":15,"n_cols":6,"rows_kept":15,"cut":false,"hidden":false,"merged":[[1,4,2,5]]}
[]
[null,null,null,null,"Set a description for each effort and priority level to ensure that the organization understand the level which they work with throughout the document"]
[]
[null,null,null,null,"Effort Level ","Description"]
[null,null,null,null,"Low "]
[null,null,null,null,"Medium "]
[null,null,null,null,"High"]
[]
[]
[null,null,null,null,"Priority Level","Description"]
[null,null,null,null,1]
[null,null,null,null,2]
[null,null,null,null,3]
[null,null,null,null,4]
[null,null,null,null,5]

{"sheet":"Overall results","index":1,"n_rows":13,"n_cols":12,"rows_kept":13,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks "]

{"sheet":"Task Manager ","index":2,"n_rows":44,"n_cols":10,"rows_kept":44,"cut":false,"hidden":false,"merged":[[2,2,2,9]]}
[]
[]
[null,null,"Tasks to meet DORA requirments"]
[]
[]
[null,null,"Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"","Do you meet the requirements today?","Percentage done ","Priority","Effort Level","Task ","Responsible ","Due date"]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]
[null,null,null,{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,6,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,7,FALSE),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,8,FALSE),\"\")","v":""},{"$f":"+IFERROR(VLOOKUP(Table11[[#This Row],[Question \n\"The drop-down-list contains all questions from the Overall results table meaning all questions answered with either \"no\" or \"partly\"]],'Overall results'!$C$14:$L$142,9,FALSE),\"\")","v":""}]

{"sheet":"ICT Risk Management","index":3,"n_rows":97,"n_cols":12,"rows_kept":97,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,null,null,null,null,"You can use the filter box to find specific sections by using phrases like \"Business Continuity\" or \"Cyber Security\""]
[null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks "]
[null,"ICT Risk management ","Does your organization have an internal governance and control framework in place to ensure effective and prudent management of ICT risk?",5,1,"Financial entities shall have in place an internal governance and control framework that \nensures an effective and prudent management of ICT risk, in accordance with Article 6(4), \nin order to achieve a high level of digital operational resilience."," "]
[null,"ICT Risk management ","Does your management body define, oversee and take responsibility for the ICT risk management framework?",5,2,"The management body of the financial entity shall define, approve, oversee and be \nresponsible for the implementation of all arrangements related to the ICT risk management \nframework referred to in Article 6(1)."]
[null,"ICT Risk management ","Does your management body bear the ultimate responsibility for managing the organization's ICT risk?",5,2,"(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;"]
[null,"ICT Risk management ","Does your organization maintain policies to ensure high standards of data availability, authenticity, integrity, and confidentiality?",5,2,"(b) put in place policies that aim to ensure the maintenance of high standards of \navailability, authenticity, integrity and confidentiality, of data;"]
[null,"ICT Risk management ","Does your organization set clear roles and responsibilities for all ICT-related functions?",5,2,"(c) set clear roles and responsibilities for all ICT-related functions and establish \nappropriate governance arrangements to ensure effective and timely communication, \ncooperation and coordination among those functions;"]
[null,"ICT Risk management ","Does your management body bear overall responsibility for setting and approving the digital operational resilience strategy as referred to in Article 6(8), including the determination of the appropriate risk tolerance level of ICT risk of the organization, as referred to in Article 6(8), point (b)?",5,2,"(d) bear the overall responsibility for setting and approving the digital operational \nresilience strategy as referred to in Article 6(8), including the determination of the \nappropriate risk tolerance level of ICT risk of the financial entity, as referred to in \nArticle 6(8), point (b);"]
[null,"ICT Risk management ","Does your management body approve, oversee, and periodically review the implementation and upkeep of the ICT business continuity policy?",5,2,"(e) approve, oversee and periodically review the implementation of the financial entity’s \nICT business continuity policy and ICT response and recovery plans, referred to, \nrespectively, in Article 11(1) and (3), which may be adopted as a dedicated specific \npolicy forming an integral part of the financial entity’s overall business continuity \npolicy and response and recovery plan;"]
[null,"ICT Risk management ","Does your management body approve and periodically review ICT internal audit plans, ICT audits, and modifications to them?",5,2,"(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT \naudits and material modifications to them;"]
[null,"ICT Risk management ","Does your management body allocate and periodically review the appropriate budget to fulfill the financial entity's digital operational resilience, including ICT security awareness programs and digital resilience training?",5,2,"(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s \ndigital operational resilience needs in respect of all types of resources, including \nrelevant ICT security awareness programmes and digital operational resilience \ntraining referred to in Article 13(6), and ICT skills for all staff;"]
[null,"ICT Risk management ","Does your management body approve and periodically review all ICT service providers?",5,2,"(h) approve and periodically review the financial entity’s policy on arrangements \nregarding the use of ICT services provided by ICT third-party service providers;"]
[null,"ICT Risk management ","Does your entity have reporting channels in place at the corporate level to inform the organization about the arrangements concluded with ICT third-party service providers and the potential impact of such changes on the critical or important functions subject to those arrangements?",5,2,"(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:"]
[null,"ICT Risk management ","Do financial entities, other than microenterprises, establish a role to monitor the arrangements concluded with ICT third-party service providers?",5,2,"(i) arrangements concluded with ICT third-party service providers on the use of ICT services,"]
[null,"ICT Risk management ","Does the organization have a role to monitor the arrangements provided by ICT third party providers? ",5,3,"3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.","Other than microenterprises "]
[null,"ICT Risk management ","Does the management members of the organizations actively keep up to date with sufficient knowledge and skills to understand and assess ICT risks and its impacts of the operations?",5,4,"4. Members of the management body of the financial entity shall actively keep up to date \nwith sufficient knowledge and skills to understand and assess ICT risk and its impact on \nthe operations of the financial entity, including by following specific training on a regular \nbasis, commensurate to the ICT risk being managed."]
[null,"ICT Risk management ","Does the organization have a sound comprehensive and well-documented ICT risk management framework?",6,1,"1. Financial entities shall have a sound, comprehensive and well-documented ICT risk \nmanagement framework as part of their overall risk management system, which enables \nthem to address ICT risk quickly, efficiently and comprehensively and to ensure a high \nlevel of digital operational resilience."]
[null,"ICT Risk management ","The organization has ICT risk management Strategies?",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT risk management Policies?",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT risk management Procedures?",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT Risk management Protocols?",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","Does the organization minimize ICT risks by having strategies, policies, procedures, ICT protocols, and tools in place?",6,3,"3. In accordance with their ICT risk management framework, financial entities shall minimise \nthe impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT \nprotocols and tools. They shall provide complete and updated information on ICT risk and \non their ICT risk management framework to the competent authorities upon their request."]
[null,"ICT Risk management ","Is all information relating to ICT risks completed and updated in a database and provided to the competent authorities?",6,4,"4. Financial entities, other than microenterprises, shall assign the responsibility for managing \nand overseeing ICT risk to a control function and ensure an appropriate level of \nindependence of such control function in order to avoid conflicts of interest. Financial \nentities shall ensure appropriate segregation and independence of ICT risk management \nfunctions, control functions, and internal audit functions, according to the three lines of \ndefence model, or an internal risk management and control model.","Other than microenterprises "]
[null,"ICT Risk management ","Has the organization assigned responsibilities for managing and overseeing ICT risk to a control function that needs to be independent and separated in accordance with the three lines of defense?",6,4,"4. Financial entities, other than microenterprises, shall assign the responsibility for managing \nand overseeing ICT risk to a control function and ensure an appropriate level of \nindependence of such control function in order to avoid conflicts of interest. Financial \nentities shall ensure appropriate segregation and independence of ICT risk management \nfunctions, control functions, and internal audit functions, according to the three lines of \ndefence model, or an internal risk management and control model.","Other than microenterprises "]
[null,"ICT Risk management ","Is a review cycle put in place once a year or whenever a significant incident occurs, or larger changes to the organization take place?",6,5,"5. The ICT risk management framework shall be documented and reviewed at least once a \nyear, or periodically in the case of microenterprises, as well as upon the occurrence of \nmajor ICT-related incidents, and following supervisory instructions or conclusions derived \nfrom relevant digital operational resilience testing or audit processes. It shall be \ncontinuously improved on the basis of lessons derived from implementation and \nmonitoring. A report on the review of the ICT risk management framework shall be \nsubmitted to the competent authority upon its request.","Other than microenterprises "]
[null,"ICT Risk management ","Does the internal audit organization have sufficient knowledge, skills and expertise to audit the ICT Risk Management Framework?",6,6,"6. The ICT risk management framework of financial entities, other than microenterprises, \nshall be subject to internal audit by auditors on a regular basis in line with the financial \nentities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise \nin ICT risk, as well as appropriate independence. The frequency and focus of ICT audits \nshall be commensurate to the ICT risk of the financial entity.","Other than microenterprises "]
[null,"ICT Risk management ","Does the internal audit organization have the capability to audit regularly?",6,7,"7. Based on the conclusions from the internal audit review, financial entities shall establish a \nformal follow-up process, including rules for the timely verification and remediation of \ncritical ICT audit findings."]
[null,"ICT Risk management ","Does the internal audit organization have the capability and organization to create/update follow-ups?",6,7,"7. Based on the conclusions from the internal audit review, financial entities shall establish a \nformal follow-up process, including rules for the timely verification and remediation of \ncritical ICT audit findings."]
[null,"ICT Risk management ","Does the Risk Management Framework include?:",6,8,"8. The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by:"]
[null,"ICT Risk management ","Does the RMF include: Business strategy and objectives as they relate to the ICT risk management framework",6,8,"(a) explaining how the ICT risk management framework supports the financial entity’s \nbusiness strategy and objectives;"]
[null,"ICT Risk management ","Does the RMF include: An established risk tolerance level for ICT risk?",6,8,"(b) establishing the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions;"]
[null,"ICT Risk management ","Does the RMF include: Clear information security objectives, including key performance indicators and key risk metrics?",6,8,"(c) setting out clear information security objectives, including key performance indicators and key risk metrics;"]
[null,"ICT Risk management ","Does the RMF include: Explaining the ICT reference architecture and how it relates to specific business objectives?",6,8,"(d) explaining the ICT reference architecture and any changes needed to reach specific business objectives;"]
[null,"ICT Risk management ","Does the RMF include: Outline mechanisms to detect ICT-related incidents, prevent their impact and provide protection from them?",6,8,"(e) outlining the different mechanisms put in place to detect ICT-related incidents, \nprevent their impact and provide protection from it;"]
[null,"ICT Risk management ","Does the RMF include: Situational awareness for major ICT-related incidents?",6,8,"(f) evidencing the current digital operational resilience situation on the basis of the \nnumber of major ICT-related incidents reported and the effectiveness of preventive \nmeasures;"]
[null,"ICT Risk management ","Does the RMF include: Implemented digital operational resilience testing?",6,8,"(g) implementing digital operational resilience testing, in accordance with Chapter IV of \nthis Regulation;"]
[null,"ICT Risk management ","Does the RMF include: Outline a communication strategy in case of an ICT incident?",6,8,"(h) outlining a communication strategy in the event of ICT-related incidents the \ndisclosure of which is required in accordance with Article 14."]
[null,"ICT Risk management ","Does the organization have a holistic ICT multi-vendor strategy at the group level?",6,9,"Financial entities may, in the context of the digital operational resilience strategy referred to in paragraph 8, define a holistic ICT multi-vendor strategy, at group or entity level, showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers."]
[null,"ICT Risk management ","The organization can outsource the task of verifying compliance of the ICT Risk Management to both intra-group and external undertakers?",6,10,"Financial entities may, in accordance with Union and national sectoral law, outsource the \ntasks of verifying compliance with ICT risk management requirements to intra-group or \nexternal undertakings. In case of such outsourcing, the financial entity remains fully \nresponsible for the verification of compliance with the ICT risk management requirements."]
[null,"ICT Risk management ","In order to address and manage ICT risk, does the financial entity use and maintain updated ICT systems, protocols, and tools that are:?",7,1,"In order to address and manage ICT risk, financial entities shall use and maintain updated ICT \nsystems, protocols and tools that are:"]
[null,"ICT Risk management ","ICT systems, protocols, and tools that are: Appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4.",7,1,"(a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;"]
[null,"ICT Risk management ","(b) reliable;",7,1,"(b) reliable;"]
[null,"ICT Risk management ","ICT systems, protocols, and tools that are: Equipped with sufficient capacity to accurately process data necessary for performance of activities and timely provision of services, including peak orders and new technology?",7,1,"(c) equipped with sufficient capacity to accurately process the data necessary for the \nperformance of activities and the timely provision of services, and to deal with peak orders, \nmessage or transaction volumes, as needed, including where new technology is introduced;"]
[null,"ICT Risk management ","ICT systems, protocols, and tools that are: Technologically resilient to adequately deal with additional information processing needs required under stressed market conditions or other adverse situations?",7,1,"(d) technologically resilient in order to adequately deal with additional information processing \nneeds as required under stressed market conditions or other adverse situations."]
[null,"ICT Risk management ","Does the organization identify, classify and adequately document all ICT supported functions, roles, responsibilities, information and other ICT assets supporting those functions?",8,1,"As part of the ICT risk management framework referred to in Article 6(1), financial \nentities shall identify, classify and adequately document all ICT supported business \nfunctions, roles and responsibilities, the information assets and ICT assets supporting those \nfunctions, and their roles and dependencies in relation to ICT risk. Financial entities shall \nreview as needed, and at least yearly, the adequacy of this classification and of any \nrelevant documentation."]
[null,"ICT Risk management ","Does the organization identify all sources of ICT risks, especially those coming from other financial entities, cyber threats and ICT vulnerabilities?",8,2,"2. Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them."]
[null,"ICT Risk management ","Does the organization conduct risk assessments on major changes in the network?",8,3,"3. Financial entities, other than microenterprises, shall perform a risk assessment upon each \nmajor change in the network and information system infrastructure, in the processes or \nprocedures affecting their ICT supported business functions, information assets or ICT \nassets.","Other than microenterprises "]
[null,"ICT Risk management ","Does the organization identify all information assets and ICT assets, including remote sites, network resources and hardware equipment?",8,4,"4. Financial entities shall identify all information assets and ICT assets, including those on \nremote sites, network resources and hardware equipment, and shall map those considered \ncritical. They shall map the configuration of the information assets and ICT assets and the \nlinks and interdependencies between the different information assets and ICT assets."]
[null,"ICT Risk management ","Does the organization identify all processes dependent on ICT third-party service providers and their interdependencies with third-party service providers that work with critical or important functions?",8,5,"5. Financial entities shall identify and document all processes that are dependent on ICT \nthird-party service providers, and shall identify interconnections with ICT third-party \nservice providers that provide services that support critical or important functions."]
[null,"ICT Risk management ","Does the organization maintain relevant inventories and update them periodically and every time any major change, as referred to in paragraph 3?",8,6,"6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant \ninventories and update them periodically and every time any major change as referred to in \nparagraph 3 occurs."]
[null,"ICT Risk management ","Does the organization conduct a yearly risk assessment on all legacy systems?",8,7,"7. Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, \nconduct a specific ICT risk assessment on all legacy ICT systems and, in any case before \nand after connecting technologies, applications or systems.","Other than microenterprises "]
[null,"ICT Risk management ","Has the organization implemented continuous monitoring and control mechanisms for the security and functioning of ICT systems and tools, as well as minimization measures for the impact of ICT risk?",9,1,"For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures."]
[null,"ICT Risk management ","Have the organization designed, procured, and implemented ICT security policies, procedures, protocols and tools to ensure the resilience, continuity, and availability of ICT systems, particularly for critical or important functions, and to maintain high standards of data availability, authenticity, integrity and confidentiality?",9,2,"Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit."]
[null,"ICT Risk management ","Have the organization used ICT solutions and processes that are appropriate and meet the requirements of ensuring secure data transfer means and minimizing the risk of data corruption, loss, unauthorised access, and technical flaws that may hinder business activity, prevent lack of availability, and ensure that data is protected from risks arising from data management?",9,"3.","In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall: (a) ensure the security of the means of transfer of data; (b) minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity; (c) prevent the lack of availability, the impairment of the authenticity and integrity, the \nbreaches of confidentiality and the loss of data; (d) ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error."]
[null,"ICT Risk management ","Does the organization as part of their ICT Risk Management framework cover:",9,4,"4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall: (a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;(b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;(c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof (d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;(e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner; (f) have appropriate and comprehensive documented policies for patches and updates."]
[null,"ICT Risk management ","ICT Risk Management framework cover: An information security policy defining rules to protect the availability, authenticity, integrity and confidentiality",9,4,"(a) develop and document an information security policy defining rules to protect the \navailability, authenticity, integrity and confidentiality of data, information assets \nand ICT assets, including those of their customers, where applicable;"]
[null,"ICT Risk management ","ICT Risk Management framework cover: Following a risk-based approach, established a sound network and infrastructure management",9,4,"(b) following a risk-based approach, establish a sound network and infrastructure \nmanagement structure using appropriate techniques, methods and protocols that may \ninclude implementing automated mechanisms to isolate affected information assets \nin the event of cyber-attacks;"]
[null,"ICT Risk management ","ICT Risk Management framework cover: Implement policies that limit the physical or logical access to information assets and ICT assets",9,4,"(c) implement policies that limit the physical or logical access to information assets and \nICT assets to what is required for legitimate and approved functions and activities \nonly, and establish to that end a set of policies, procedures and controls that address \naccess rights and ensure a sound administration thereof;"]
[null,"ICT Risk management ","ICT Risk Management framework cover: Implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes",9,4,"(d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes"]
[null,"ICT Risk management ","ICT Risk Management framework cover: Implement documented policies, procedures and controls for ICT change management",9,4,"(e) implement documented policies, procedures and controls for ICT change \nmanagement, including changes to software, hardware, firmware components, \nsystems or security parameters, that are based on a risk assessment approach and are \nan integral part of the financial entity’s overall change management process, in order \nto ensure that all changes to ICT systems are recorded, tested, assessed, approved, \nimplemented and verified in a controlled manner;"]
[null,"ICT Risk management ","ICT Risk Management framework cover: Have appropriate and comprehensive documented policies for patches and updates.",9,4,"(f) have appropriate and comprehensive documented policies for patches and updates."]
[null,"ICT Risk management ","Does the organization have mechanisms in place to promptly detect anomalous activities such as: ICT performance issues and ICT related incidents?",10,1,"1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, \nin accordance with Article 17, including ICT network performance issues and ICT-related \nincidents, and to identify potential material single points of failure."]
[null,"ICT Risk management ","Does the dedection mechanism have layers of control, defined alerts and criteria to trigger ICT related incident response processes. ",10,2,"2. The detection mechanisms referred to in paragraph 1 shall enable multiple layers of \ncontrol, define alert thresholds and criteria to trigger and initiate ICT-related incident \nresponse processes, including automatic alert mechanisms for relevant staff in charge of \nICT-related incident response."]
[null,"ICT Risk management ","Is the mechanism tested regularly?",10,1,"All detection mechanisms referred to in the first subparagraph shall be regularly tested in \naccordance with Article 25."]
[null,"ICT Risk management ","Does the organization ensure that they have sufficient resources and capabilities to monitor user activity, ICT anomalies, and incidents?",10,3,"Financial entities shall devote sufficient resources and capabilities to monitor user activity, \nthe occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks."]
[null,"ICT Risk management ","Does the organization have effective systems to check trade reports for completeness and identify errors?",10,4,"Data reporting service providers shall, in addition, have in place systems that can \neffectively check trade reports for completeness, identify omissions and obvious errors, \nand request re-transmission of those reports."]
[null,"ICT Risk management ","Does the organization have a comprehensive ICT business continuity policy as an integrated part of the operational business continuity policy of the financial entity?",11,1,"1. As part of the ICT risk management framework referred to in Article 6(1) and based on the \nidentification requirements set out in Article 8, financial entities shall put in place a \ncomprehensive ICT business continuity policy, which may be adopted as a dedicated \nspecific policy, forming an integral part of the overall business continuity policy of the \nfinancial entity."]
[null,"ICT Risk management ","Does the ICT business continuity policy referred to in article 10,1 have arrangements, plans, procedures, and mechanisms aimed at:\n(a) ensuring the continuity of the financial entity’s critical or important functions; (b) quickly, appropriately, and effectively responding to, and resolving, all ICT-related incidents in a way that limits damage and prioritizes the resumption of activities and recovery actions; (c) activating, without delay, dedicated plans that enable containment measures, processes, and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12; (d) estimating preliminary impacts, damages, and losses; (e) setting out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and reporting to the competent authorities in accordance with Article 19.",11,2,"2. Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aiming to:(a) ensure the continuity of the financial entity’s critical or important functions;(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and \nrecovery actions;(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;(d) estimate preliminary impacts, damages and losses;(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19."]
[null,"ICT Risk management ","Does the organization have ICT Disaster Recovery plans in place, which can be audited by an independent auditor?",11,3,"3. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews.","Other than microenterprises (in relation to the auditability by independent auditors)"]
[null,"ICT Risk management ","Are all ICT business continuity plans especially with regards to Critical or Important functions outsourced tested appropriately? Is this done in your organization?",11,4,"Financial entities shall put in place, maintain and periodically test appropriate ICT business \ncontinuity plans, notably with regard to critical or important functions outsourced or \ncontracted through arrangements with ICT third-party service providers."]
[null,"ICT Risk management ","Does the organization do the following as part of their comprehensive ICT risk management: (a) test the ICT Business Continuity Policy and the ICT Disaster Recovery Plan at least yearly and after substantive changes to the ICT systems; (b) test the crisis communication plans established in accordance with Article 13?",11,6,"As part of their comprehensive ICT risk management, financial entities shall:\n(a) test the ICT business continuity plans and the ICT response and recovery plans in \nrelation to ICT systems supporting all functions at least yearly, as well as in the event \nof any substantive changes to ICT systems supporting critical or important functions;\n(b) test the crisis communication plans established in accordance with Article 14."]
[null,"ICT Risk management ","Does your organization have a comprehensive Crisis Management function which can be activated in accordance with the business continuity policy or disaster recovery plans?",11,7,"Financial entities, other than microenterprises, shall have a crisis management function, \nwhich, in the event of activation of their ICT business continuity plans or ICT response and \nrecovery plans, shall, inter alia, set out clear procedures to manage internal and external \ncrisis communications in accordance with Article 14.","Other than microenterprises "]
[null,"ICT Risk management ","Does your organization have clear guidelines for tracking all events taking place before, during and after a disruptive event?",11,8,"Financial entities shall keep readily accessible records of activities before and during \ndisruption events when their ICT business continuity plans and ICT response and recovery \nplans are activated."]
[null,"ICT Risk management ","Does the organization have the capabilities to share all tests and exercise reports with authorities?",11,9,"Central securities depositories shall provide the competent authorities with copies of the \nresults of the ICT business continuity tests, or of similar exercises."]
[null,"ICT Risk management ","Does the organization have the capabilities to report on the losses caused by an ICT disruption?",11,10,"Financial entities, other than microenterprises, shall report to the competent authorities, \nupon their request, an estimation of aggregated annual costs and losses caused by \nmajor ICT-related incidents.","Other than microenterprises "]
[null,"ICT Risk management ","Does your organization, as part of the business continuity policy, conduct a Business Impact Analysis of their exposures to severe business disruption?",11,5,"As part of the overall business continuity policy, financial entities shall conduct a business \nimpact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, \nfinancial entities shall assess the potential impact of severe business disruptions by means \nof quantitative and qualitative criteria, using internal and external data and scenario \nanalysis, as appropriate. The BIA shall consider the criticality of identified and mapped \nbusiness functions, support processes, third-party dependencies and information assets, and \ntheir interdependencies. Financial entities shall ensure that ICT assets and ICT services are \ndesigned and used in full alignment with the BIA, in particular with regard to adequately \nensuring the redundancy of all critical components."]
[null,"ICT Risk management ","Does the ICT Risk Management Framework contain these elements in order to ensure that ICT systems and data can be restored with minimum downtime: (a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data; (b) restoration and recovery procedures and methods?",12,1,"For the purpose of ensuring the restoration of ICT systems and data with minimum \ndowntime, limited disruption and loss, as part of their ICT risk management framework, \nfinancial entities shall develop and document:\n(a) backup policies and procedures specifying the scope of the data that is subject to the \nbackup and the minimum frequency of the backup, based on the criticality of \ninformation or the confidentiality level of the data;\n(b) restoration and recovery procedures and methods"]
[null,"ICT Risk management ","Does the organization have backup systems that can be activated in accordance with the backup policy and procedures as well as restoration and recovery procedures and methods? The organization needs to ensure that the activation of the backup systems shall not jeopardize the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data.",12,2,"Financial entities shall set up backup systems that can be activated in accordance with the \nbackup policies and procedures, as well as restoration and recovery procedures and \nmethods. The activation of backup systems shall not jeopardise the security of the network \nand information systems or the availability, authenticity, integrity or confidentiality of \ndata. Testing of the backup procedures and restoration and recovery procedures and \nmethods shall be undertaken periodically."]
[null,"ICT Risk management ","Does the organization have separate backup systems that are segregated from the source ICT system?",12,3,"When restoring backup data using own systems, financial entities shall use ICT systems \nthat are physically and logically segregated from the source ICT system. The ICT systems \nshall be securely protected from any unauthorised access or ICT corruption and allow for \nthe timely restoration of services making use of data and system backups as necessary."]
[null,"ICT Risk management ","Does the organization maintain redundant ICT capacities equipped with resources, capabilities, and functions that are adequate to ensure business needs?",12,4,"Financial entities, other than microenterprises, shall maintain redundant ICT capacities \nequipped with resources, capabilities and functions that are adequate to ensure business \nneeds. Microenterprises shall assess the need to maintain such redundant ICT capacities \nbased on their risk profile.","Other than microenterprises "]
[null,"ICT Risk management ","If the organization has central securities depositories, it should maintain at least one secondary processing site endowed with adequate resources, capabilities, functions, and staffing arrangements to ensure business needs. The secondary site should: (a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event which has affected the primary site; (b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives; (c) immediately accessible to the financial entity's staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable.",12,5,"Central securities depositories shall maintain at least one secondary processing site endowed with adequate resources, capabilities, functions and staffing arrangements to ensure business needs. The secondary processing site shall be:\n(a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event whichhas affected the primary site;\n(b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;\n(c) immediately accessible to the financial entity’s staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable."]
[null,"ICT Risk management ","The organization shall determine the recovery time and recovery point objectives for each function. Financial entities shall take into account whether it is a critical or important function potential overall impact on market efficiency.",12,6,"In determining the recovery time and recovery point objectives for each function, financial \nentities shall take into account whether it is a critical or important function and the \npotential overall impact on market efficiency. Such time objectives shall ensure that, in \nextreme scenarios, the agreed service levels are met."]
[null,"ICT Risk management ","Does the organization ensure that lessons learned sessions are held after ICT related incidents occur and the organization is recovered, all checks, including any multiple checks and reconciliations?",12,7,"When recovering from an ICT-related incident, financial entities shall perform necessary checks, including any multiple checks and reconciliations, in order to ensure that the highest level of data integrity is maintained. These checks shall also be performed when reconstructing data from external stakeholders, in order to ensure that all data is consistent between systems."]
[null,"ICT Risk management ","Does the organization have the capabilities and staff to gather information on vulnerabilities, cyber threats and ICT related incidents? The organization should also be able to analyze the impact.",13,1,"Financial entities shall have in place capabilities and staff to gather information on \nvulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience."]
[null,"ICT Risk management ","Does the organization have in place a method to do ICT related incident reviews \"lessons learned\"? Both Causes and Improvements should be identified.",13,2,"Financial entities shall put in place post ICT-related incident reviews after a major \nICT-related incident disrupts their core activities, analysing the causes of disruption and \nidentifying required improvements to the ICT operations or within the ICT business \ncontinuity policy referred to in Article 11."]
[null,"ICT Risk management ","Does the organization have the capability to communicate any changes made after a serious ICT incident?",13,2,"Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph.","Other than microenterprises "]
[null,"ICT Risk management ","Does the organization have the capability to create a ICT related incident reviews which shall determine whether the procedures were followed? All of these factors need to be included: (a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity; (b) the quality and speed of performing a forensic analysis, where deemed appropriate; (c) the effectiveness of incident escalation within the financial entity; (d) the effectiveness of internal and external communication.",13,2,"The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following: \n(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity; \n(b) the quality and speed of performing a forensic analysis, where deemed appropriate; \n(c) the effectiveness of incident escalation within the financial entity; \n(d) the effectiveness of internal and external communication."]
[null,"ICT Risk management ","Does the organization have mechanisms to take lessons from the digital operational resilience testing? These lessons should be especially focused on Cyber Attack, activation of ICT Business Continuity Plans, and ICT response and recovery plans.",13,3,"Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1)."]
[null,"ICT Risk management ","Does the organization monitor the effectiveness of its implementation of the digital operational resilience strategy?",13,4,"Financial entities shall monitor the effectiveness of the implementation of their digital operational resilience strategy set out in Article 6(8). They shall map the evolution of ICT risk over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity."]
[null,"ICT Risk management ","Do the senior ICT staff in the organization report to management at least once a year?",13,5,"Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3 and put forward recommendations."]
[null,"ICT Risk management ","Does the organization have general training programs for ICT security awareness and digital operational resilience?",13,6,"Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i)."]
[null,"ICT Risk management ","Does the organization have the capability to monitor relevant technological developments and their potential impact on the organization?",13,7,"Financial entities, other than microenterprises, shall monitor relevant technological developments on a continuous basis, also with a view to understanding the possible impact of the deployment of such new technologies on ICT security requirements and digital operational resilience. They shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks.","Other than microenterprises "]
[null,"ICT Risk management ","Does the organization have crisis communication plans in place to enable clear communication about potential ICT-related incidents?",14,1,"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate."]
[null,"ICT Risk management ","Does the organization have policies for internal and external stakeholder communication, with a focus on staff responsible for incident response and those who need information?",14,2,"As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed."]
[null,"ICT Risk management ","Is there at least one person responsible for implementing the communication strategy for ICT-related incidents?",14,3,"At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose."]

{"sheet":"ICT-related incident management","index":4,"n_rows":24,"n_cols":12,"rows_kept":24,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[null,null,null,null,null,"You can use the filter box to find specific sections by using phrases like \"Business Continuity\" or \"Cyber Security\""]
[null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks "]
[null,"ICT-related incident management, classification and reporting","Does the organization define, establish and implement an incident management process for ICT-related incidents to detect, manage, and notify them?",17,1,"Financial entities shall define, establish and implement an ICT-related incident \nmanagement process to detect, manage and notify ICT-related incidents."]
[null,"ICT-related incident management, classification and reporting","Does the organization record all ICT-related incidents and significant cyber threats?",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents."]
[null,"ICT-related incident management, classification and reporting","Has the organization established appropriate procedures and processes to ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents?",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents."]
[null,"ICT-related incident management, classification and reporting","Do the procedures and processes include identification and documentation?",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents."]
[null,"ICT-related incident management, classification and reporting","Has the organization established early warning indicators as part of its ICT-related incident management process?",17,3,"The ICT-related incident management process referred to in paragraph 1 shall:\n(a) put in place early warning indicators;"]
[null,"ICT-related incident management, classification and reporting","Has the organization established procedures to identify, track, log, categorize and classify ICT-related incidents according to their priority and severity?",17,3,"(b) establish procedures to identify, track, log, categorise and classify ICT-related \nincidents according to their priority and severity and according to the criticality of \nthe services impacted, in accordance with the criteria set out in Article 18(1);"]
[null,"ICT-related incident management, classification and reporting","Has the organization assigned roles and responsibilities that need to be activated for different types and scenarios of ICT-related incidents, according to the criticality of the impacted services, in accordance with the criteria set out in Article 18(1)?",17,3,"(c) assign roles and responsibilities that need to be activated for different ICT-related \nincident types and scenarios;"]
[null,"ICT-related incident management, classification and reporting","Has the organization developed plans for communication to staff, external stakeholders and media in accordance with Article 14?",17,3,"(d) set out plans for communication to staff, external stakeholders and media in \naccordance with Article 14 and for notification to clients, for internal escalation \nprocedures, including ICT-related customer complaints, as well as for the provision \nof information to financial entities that act as counterparts, as appropriate;"]
[null,"ICT-related incident management, classification and reporting","Has the organization developed plans for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate?",17,3,"(d) set out plans for communication to staff, external stakeholders and media in \naccordance with Article 14 and for notification to clients, for internal escalation \nprocedures, including ICT-related customer complaints, as well as for the provision \nof information to financial entities that act as counterparts, as appropriate;"]
[null,"ICT-related incident management, classification and reporting","Has the organization developed plans to ensure that at least major ICT-related incidents are reported to relevant senior management and the management body of at least major ICT-related incidents?",17,3,"(e) ensure that at least major ICT-related incidents are reported to relevant senior \nmanagement and inform the management body of at least major ICT-related \nincidents, explaining the impact, response and additional controls to be established as \na result of such ICT-related incidents;"]
[null,"ICT-related incident management, classification and reporting","Does the organization explain the impact, response and additional controls established as a result of such ICT-related incidents?",17,3,"(e) ensure that at least major ICT-related incidents are reported to relevant senior \nmanagement and inform the management body of at least major ICT-related \nincidents, explaining the impact, response and additional controls to be established as \na result of such ICT-related incidents;"]
[null,"ICT-related incident management, classification and reporting","Has the organization established ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner?",17,3,"(f) establish ICT-related incident response procedures to mitigate impacts and ensure \nthat services become operational and secure in a timely manner."]
[null,"ICT-related incident management, classification and reporting","Does the organization classify ICT-related incidents and determine their impact based on the following criteria: a) The number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact. b) The duration of the ICT-related incident, including the service downtime. c) The geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States. d) The data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity, or confidentiality of data. e) The criticality of the services affected, including the financial entity’s transactions and operations. f) The economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.",18,1,"Financial entities shall classify ICT-related incidents and shall determine their impact \nbased on the following criteria:\n(a) the number and/or relevance of clients or financial counterparts affected and, where \napplicable, the amount or number of transactions affected by the ICT-related \nincident, and whether the ICT-related incident has caused reputational impact;\n(b) the duration of the ICT-related incident, including the service downtime;\n(c) the geographical spread with regard to the areas affected by the ICT-related incident, \nparticularly if it affects more than two Member States;\n(d) the data losses that the ICT-related incident entails, in relation to availability, \nauthenticity, integrity or confidentiality of data;\n(e) the criticality of the services affected, including the financial entity’s transactions \nand operations;\n(f) the economic impact, in particular direct and indirect costs and losses, of the ICT\u0002related incident in both absolute and relative terms."]
[null,"ICT-related incident management, classification and reporting","Does the organization classify cyber threats based on the service at risk, its impact on transactions and operations, and the number of relevant clients or financial counterparts?",18,2,"Financial entities shall classify cyber threats as significant based on the criticality of the \nservices at risk, including the financial entity’s transactions and operations, number and/or relevance of clients or financial counterparts targeted and the geographical spread of the areas at risk"]
[null,"ICT-related incident management, classification and reporting"," Does the organization report major ICT-related incidents to the relevant competent authority using templates referred to in Article 20?",19,1,"Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article."]
[null,"ICT-related incident management, classification and reporting","Does the organization voluntarily notify significant cyber threats to the relevant competent authority?",19,2,"Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system,  service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.","Voluntary for all companies"]
[null,"ICT-related incident management, classification and reporting","Does the organization inform its clients without undue delay in the event of major ICT-related incidents that have an impact on their financial interests or significant cyber threats?",19,3,"Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident."]
[null,"ICT-related incident management, classification and reporting","Does the organization submit an initial notification, intermediate report and final report to the relevant competent authority within specified time limits using the templates referred to in Article 20?",19,4,"Financial entities shall, within the time-limits to be laid down in accordance with \nArticle 20, first subparagraph, point (a), point (2), submit the following to the relevant \ncompetent authority:\n(a) an initial notification;\n(b) an intermediate report after the initial notification referred to in point (a), as soon as \nthe status of the original incident has changed significantly or the handling of the \nmajor ICT-related incident has changed based on new information available, \nfollowed, as appropriate, by updated notifications every time a relevant status update \nis available, as well as upon a specific request of the competent authority;"]
[null,"ICT-related incident management, classification and reporting","Does the organization outsource reporting obligations to a third-party service provider but remain fully responsible for meeting the reporting requirements?",19,4,"Financial entities shall, within the time-limits to be laid down in accordance with Article 20, first subparagraph, point (a), point (2), submit the following to the relevant competent authority: (a) an initial notification; (b) an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority;"]

{"sheet":"Testing","index":5,"n_rows":16,"n_cols":12,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,"You can use the filter box to find specific sections by using phrases like \"Business Continuity\" or \"Cyber Security\""]
[null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks "]
[null,"Digital operational resilience testing","Does your organization establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of the ICT risk-management framework referred to in Article 6?",24,1,"For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.","other than microenterprises"]
[null,"Digital operational resilience testing","Does the organization's program include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26?",24,2,"The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26."]
[null,"Digital operational resilience testing","When conducting the digital operational resilience testing program referred to in paragraph 1 of this Article, does your organization follow a risk-based approach taking into account the criteria set out in Article 4(2)?\n\na) Does your organization duly consider the evolving landscape of ICT risk, any specific risks to which the organization is or might be exposed?\n\nb) Does your organization duly consider the criticality of information assets and services provided, as well as any other factor the financial entity deems appropriate?",24,3,"3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.","other than microenterprises"]
[null,"Digital operational resilience testing","Does the organization ensure that tests are undertaken by independent parties, whether internal or external?",24,4,"Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entities shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.","other than microenterprises"]
[null,"Digital operational resilience testing","Where tests are undertaken by an internal tester, does the organization dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test?",24,4,"Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entities shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.","other than microenterprises"]
[null,"Digital operational resilience testing","Has your organization established procedures and policies to prioritize, classify and remedy all issues revealed throughout the performance of the tests?",24,5,"Financial entities, other than microenterprises, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.","other than microenterprises"]
[null,"Digital operational resilience testing","Has your organization established internal validation methodologies to ascertain that all identified weaknesses, deficiencies, or gaps are fully addressed?",24,5,"Financial entities, other than microenterprises, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.","other than microenterprises"]
[null,"Digital operational resilience testing","Does your organization conduct appropriate tests on all ICT systems and applications supporting critical or important functions at least yearly?",24,6,"Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions","other than microenterprises"]

{"sheet":"Sheet6","index":6,"n_rows":47,"n_cols":9,"rows_kept":47,"cut":false,"hidden":true,"merged":[]}
["Topic ","Question","Article  ","Section","DORA Text ","Do you meet the requirements today?","% requirements meet","Priority","Comments/Tasks "]
["Third Party Risk Management","Does the organization manage ICT third party Risk as an integrated part of the overall ICT risk management framework? ",28,1,"1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk \nwithin their ICT risk management framework as referred to in Article 6(1), and in \naccordance with the following principles:","Partly",null,1]
["Third Party Risk Management","Is the organization acting as responsible for all service providers running business operations?",28,1,"(a) financial entities that have in place contractual arrangements for the use of ICT \nservices to run their business operations shall, at all times, remain fully responsible \nfor compliance with, and the discharge of, all obligations under this Regulation and \napplicable financial services law;","Partly",null,3]
["Third Party Risk Management","Is ICT third party risk implemented in light of the principle of proportionality taking into account the nature, scale, complexity and importance of ICT related dependencies",28,1,"financial entities’ management of ICT third-party risk shall be implemented in light \nof the principle of proportionality, taking into account:\n(i) the nature, scale, complexity and importance of ICT-related dependencies,\n(ii) the risks arising from contractual arrangements on the use of ICT services \nconcluded with ICT third-party service providers, taking into account the \ncriticality or importance of the respective service, process or function, and the \npotential impact on the continuity and availability of financial services and \nactivities, at individual and at group level","No",null,3]
["Third Party Risk Management","Is ICT third party risk implemented in light of the principle of proportionality taking into account the risks arising from contractual arrangements on the use of ICT services done by ICT third party service providers especially with regards to Criticality or importance service, process or function. with regard to the continuity and availbility of financial services and activities ",28,1,"financial entities’ management of ICT third-party risk shall be implemented in light \nof the principle of proportionality, taking into account:\n(i) the nature, scale, complexity and importance of ICT-related dependencies,\n(ii) the risks arising from contractual arrangements on the use of ICT services \nconcluded with ICT third-party service providers, taking into account the \ncriticality or importance of the respective service, process or function, and the \npotential impact on the continuity and availability of financial services and \nactivities, at individual and at group level"]
["Third Party Risk Management","As part of the ICT Risk management organizations should maintain and update a data base related to all contractual arrangements on the use of the ICT services provided by ICT third party ",28,1,"As part of their ICT risk management framework, financial entities shall maintain and \nupdate at entity level, and at sub-consolidated and consolidated levels, a register of \ninformation in relation to all contractual arrangements on the use of ICT services provided \nby ICT third-party service providers."]
["Third Party Risk Management","Has the organization  adapted and yearly reviewed a strategy on ICT third-party risk taking into account a multi-vendor strategy? ",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions."]
["Third Party Risk Management","Does the above mentioned strategy provide a policy for vendors serving  critical or important functions? ",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions."]
["Third Party Risk Management","Does the organizations management conduct an overall risk profile based on the third party risk? ",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions."]
["Third Party Risk Management","Does the organization keep a register for all information relating to ICT third party service providers this needs to be both sub-consolidated and consolidated? ",28,3,"As part of their ICT risk management framework, financial entities shall maintain and \nupdate at entity level, and at sub-consolidated and consolidated levels, a register of \ninformation in relation to all contractual arrangements on the use of ICT services provided \nby ICT third-party service providers"]
["Third Party Risk Management","Are all contractual arrangements documented and distinguishing those ICT services supporting critical or important ",28,3,"The contractual arrangements referred to in the first subparagraph shall be appropriately \ndocumented, distinguishing between those that cover ICT services supporting critical or \nimportant functions and those that do not."]
["Third Party Risk Management","Does the organization report regularly (yearly) to the competent authorities: which services are provided. ",28,3,"Financial entities shall report at least yearly to the competent authorities on the number of \nnew arrangements on the use of ICT services, the categories of ICT third-party service \nproviders, the type of contractual arrangements and the ICT services and functions which \nare being provided."]
["Third Party Risk Management","Does the organization have the capabilities to share the information with comptetent authorities upon request? ",28,3,"Financial entities shall make available to the competent authority, upon its request, the full \nregister of information or, as requested, specified sections thereof, along with any \ninformation deemed necessary to enable the effective supervision of the financial entity."]
["Third Party Risk Management","Does the organization have the capability to inform authorities in a timely manner about any planned contractual arrangement on the use of ICT services supporting Critical or Important Functions? ",28,3,"Financial entities shall inform the competent authority in a timely manner about any \nplanned contractual arrangement on the use of ICT services supporting critical or important \nfunctions as well as when a function has become critical or important."]
["Third Party Risk Management","Does the organization before entering into a contractual arrangement on the use of ICT services ensure: \n(a) assess whether the contractual arrangement covers the use of ICT services supporting \na critical or important function;\n(b) assess if supervisory conditions for contracting are met;\n(c) identify and assess all relevant risks in relation to the contractual arrangement, \nincluding the possibility that such contractual arrangement may contribute to \nreinforcing ICT concentration risk as referred to in Article 29;\n(d) undertake all due diligence on prospective ICT third-party service providers and \nensure throughout the selection and assessment processes that the ICT third-party \nservice provider is suitable;\n(e) identify and assess conflicts of interest that the contractual arrangement may cause.",28,4,"4. Before entering into a contractual arrangement on the use of ICT services, financial entities \nshall:\n(a) assess whether the contractual arrangement covers the use of ICT services supporting \na critical or important function;\n(b) assess if supervisory conditions for contracting are met;\n(c) identify and assess all relevant risks in relation to the contractual arrangement, \nincluding the possibility that such contractual arrangement may contribute to \nreinforcing ICT concentration risk as referred to in Article 29;\n(d) undertake all due diligence on prospective ICT third-party service providers and \nensure throughout the selection and assessment processes that the ICT third-party \nservice provider is suitable;\n(e) identify and assess conflicts of interest that the contractual arrangement may cause"]
["Third Party Risk Management","Does the organization ensure that all ICT third-parties which they enter into agreement with comply with appropriate information security standards ",28,5,"Financial entities may only enter into contractual arrangements with ICT third-party \nservice providers that comply with appropriate information security standards. When those \ncontractual arrangements concern critical or important functions, financial entities shall, \nprior to concluding the arrangements, take due consideration of the use, by ICT third-party \nservice providers, of the most up-to-date and highest quality information \nsecurity standards."]
["Third Party Risk Management","Does the organization have exercise access, inspection and audit rights over the ICT third-party service provider? Does the organization use a risk based approach to pre-determine the frequence of audits and inspections? ",28,6,"In exercising access, inspection and audit rights over the ICT third-party service provider, \nfinancial entities shall, on the basis of a risk-based approach, pre-determine the frequency \nof audits and inspections as well as the areas to be audited through adhering to commonly \naccepted audit standards in line with any supervisory instruction on the use and \nincorporation of such audit standards."]
["Third Party Risk Management","Does the organization ensure that all inspectors and auditors have the appropriate skills?",28,6,"Where contractual arrangements concluded with ICT third-party service providers on the \nuse of ICT services entail high technical complexity, the financial entity shall verify that \nauditors, whether internal or external, or a pool of auditors, possess appropriate skills and \nknowledge to effectively perform the relevant audits and assessments."]
["Third Party Risk Management","Does the organization ensure that all rights to termination of contracts are possible in case of the following:\n(a) significant breach by the ICT third-party service provider of applicable laws, \nregulations or contractual terms;\n(b) circumstances identified throughout the monitoring of ICT third-party risk that are \ndeemed capable of altering the performance of the functions provided through the \ncontractual arrangement, including material changes that affect the arrangement or \nthe situation of the ICT third-party service provider;\n(c) ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT \nrisk management and in particular in the way it ensures the availability, authenticity, \nintegrity and, confidentiality, of data, whether personal or otherwise sensitive data, or \nnon-personal data;\n(d) where the competent authority can no longer effectively supervise the financial entity \nas a result of the conditions of, or circumstances related to, the respective contractual \narrangement. ",28,7,"7. Financial entities shall ensure that contractual arrangements on the use of ICT services \nmay be terminated in any of the following circumstances:\n(a) significant breach by the ICT third-party service provider of applicable laws, \nregulations or contractual terms;\n(b) circumstances identified throughout the monitoring of ICT third-party risk that are \ndeemed capable of altering the performance of the functions provided through the \ncontractual arrangement, including material changes that affect the arrangement or \nthe situation of the ICT third-party service provider;\n(c) ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT \nrisk management and in particular in the way it ensures the availability, authenticity, \nintegrity and, confidentiality, of data, whether personal or otherwise sensitive data, or \nnon-personal data;\n(d) where the competent authority can no longer effectively supervise the financial entity \nas a result of the conditions of, or circumstances related to, the respective contractual \narrangement."]
["Third Party Risk Management","Does the organizations have exit strategies for all services providers providing services to critical or important functions ",28,8,"or ICT services supporting critical or important functions, financial entities shall put in \nplace exit strategies. The exit strategies shall take into account risks that may emerge at the \nlevel of ICT third-party service providers, in particular a possible failure on their part, a \ndeterioration of the quality of the ICT services provided, any business disruption due to \ninappropriate or failed provision of ICT services or any material risk arising in relation to \nthe appropriate and continuous deployment of the respective ICT service, or the \ntermination of contractual arrangements with ICT third-party service providers under any \nof the circumstances listed in paragraph 7.\nFinancial entities shall ensure that they are able to exit contractual arrangements without:\n(a) disruption to their business activities,\n(b) limiting compliance with regulatory requirements,\n(c) detriment to the continuity and quality of services provided to clients.\nExit plans shall be comprehensive, documented and, in accordance with the criteria set out \nin Article 4(2), shall be sufficiently tested and reviewed periodically\nFinancial entities shall identify alternative solutions and develop transition plans enabling \nthem to remove the contracted ICT services and the relevant data from the ICT third-party \nservice provider and to securely and integrally transfer them to alternative providers or \nreincorporate them in-house.\nFinancial entities shall have appropriate contingency measures in place to maintain \nbusiness continuity in the event of the circumstances referred to in the first subparagraph."]
["Third Party Risk Management","Does the organization have alternative plans for the previously named service providers providing services to critical or important functions? ",28,8,"Financial entities shall identify alternative solutions and develop transition plans enabling \nthem to remove the contracted ICT services and the relevant data from the ICT third-party \nservice provider and to securely and integrally transfer them to alternative providers or \nreincorporate them in-house."]
["Third Party Risk Management","Does the organization have contingency and business continuity plans for those providers? ",28,8,"Financial entities shall have appropriate contingency measures in place to maintain \nbusiness continuity in the event of the circumstances referred to in the first subparagraph."]
["Third Party Risk Management","Does the organization have appropriate measures in place to ensure that service providers to critical or important functions are not too hard to replace or that individual service providers have multiple contractual arrangements making the organization too reliant on them. ",29,1," When performing the identification and assessment of risks referred to in Article 28(4), \npoint (c), financial entities shall also take into account whether the envisaged conclusion of \na contractual arrangement in relation to ICT services supporting critical or important \nfunctions would lead to any of the following:\n(a) contracting an ICT third-party service provider that is not easily substitutable; or\n(b) having in place multiple contractual arrangements in relation to the provision of ICT \nservices supporting critical or important functions with the same ICT third-party \nservice provider or with closely connected ICT third-party service providers.\nFinancial entities shall weigh the benefits and costs of alternative solutions, such as the use \nof different ICT third-party service providers, taking into account if and how envisaged \nsolutions match the business needs and objectives set out in their digital resilience strategy."]
["Third Party Risk Management","Does the organization have measures in place to weigh the risk of subcontractors of  a service provider that service critical or important functions. Especially if the sub contractor is in a third country. ",29,2,"Where the contractual arrangements on the use of ICT services supporting critical or \nimportant functions include the possibility that an ICT third-party service provider further \nsubcontracts ICT services supporting a critical or important function to other ICT third\u0002party service providers, financial entities shall weigh benefits and risks that may arise in \nconnection with such subcontracting, in particular in the case of an ICT subcontractor \nestablished in a third-country."]
["Third Party Risk Management","If the service provider in a third country the organization should; under stand the risk relating to data protection ",29,2,"Where contractual arrangements on the use of ICT services supporting critical or important \nfunctions are concluded with an ICT third-party service provider established in a third \ncountry, financial entities shall, in addition to the considerations referred to in the second \nsubparagraph, also consider the compliance with Union data protection rules and the"]
["Third Party Risk Management","If the service provider in a third country the organization should; ensure that there is a possibility for effective enforcement of the law?",29,2]
["Third Party Risk Management","If the service provider in a third country the organization should; insolvency law provisions that apply in the event of a service provider going bankrupt ",29,2,"Where contractual arrangements concern ICT services supporting critical or important \nfunctions, financial entities shall duly consider the insolvency law provisions that would \napply in the event of the ICT third-party service provider’s bankruptcy as well as any \nconstraint that may arise in respect to the urgent recovery of the financial entity’s data."]
["Third Party Risk Management","If the service provider in a third country the organization should; weigh the risk of any constraints that may arise in repect to the urgent recovery of the organizations data ",29,2,"Where contractual arrangements on the use of ICT services supporting critical or important \nfunctions are concluded with an ICT third-party service provider established in a third \ncountry, financial entities shall, in addition to the considerations referred to in the second \nsubparagraph, also consider the compliance with Union data protection rules and the \neffective enforcement of the law in that third country."]
["Third Party Risk Management","Organizations should consider if long and complex sub-contractor networks may effect the way the organization can monitor the service provider. ",29,2,"Where the contractual arrangements on the use of ICT services supporting critical or \nimportant functions provide for subcontracting, financial entities shall assess whether and \nhow potentially long or complex chains of subcontracting may impact their ability to fully \nmonitor the contracted functions and the ability of the competent authority to effectively \nsupervise the financial entity in that respect."]
["Third Party Risk Management","The organization should ensure that the right and obligations of the financial entity and the ICT third party is allocated in writing and the full contract should be documented in one written document available to both parties ",30,null,"The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format"]
["Third Party Risk Management",null,30,2]
["Third Party Risk Management","A clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting.",30,2]
["Third Party Risk Management","The locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations.",30,2,"The locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations."]
["Third Party Risk Management","Provisions on availability, authenticity, integrity, and confidentiality for data protection, including personal data.",30,2,"Provisions on availability, authenticity, integrity, and confidentiality for data protection, including personal data."]
["Third Party Risk Management","Provisions for ensuring access, recovery, and return of personal and non-personal data in the event of the ICT third-party service provider's insolvency, resolution, or discontinuation of business operations or termination of the contractual arrangement.",30,2,"Provisions for ensuring access, recovery, and return of personal and non-personal data in the event of the ICT third-party service provider's insolvency, resolution, or discontinuation of business operations or termination of the contractual arrangement."]
["Third Party Risk Management","Service level descriptions, including updates and revisions thereof.",30,2,"Service level descriptions, including updates and revisions thereof."]
["Third Party Risk Management","Obligation of the ICT third-party service provider to provide assistance to the financial entity, at no additional cost, or at a cost that is determined ex-ante, in case of an ICT incident related to the ICT service provided to the financial entity.",30,2,"Obligation of the ICT third-party service provider to provide assistance to the financial entity, at no additional cost, or at a cost that is determined ex-ante, in case of an ICT incident related to the ICT service provided to the financial entity."]
["Third Party Risk Management","Obligation of the ICT third-party service provider to fully cooperate with the competent authorities and resolution authorities of the financial entity, including persons appointed by them.",30,2,"Obligation of the ICT third-party service provider to fully cooperate with the competent authorities and resolution authorities of the financial entity, including persons appointed by them."]
["Third Party Risk Management","Termination rights and related minimum notice periods for the termination of the contractual arrangement, in accordance with the expectations of competent authorities and resolution authorities.",30,2,"Termination rights and related minimum notice periods for the termination of the contractual arrangement, in accordance with the expectations of competent authorities and resolution authorities."]
["Third Party Risk Management","i) rights of access, inspection and audit by the financial entity or by an appointed third-party, and the right to take copies of relevant documentation, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;",30,2,"i) rights of access, inspection and audit by the financial entity or by an appointed third-party, and the right to take copies of relevant documentation, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;"]
["Third Party Risk Management","he full service level descriptions, including updates and revisions with precise quantitative and qualitative performance targets, to allow effective monitoring and enable corrective actions to be taken when agreed service levels are not met.",30,"3 (a)","he full service level descriptions, including updates and revisions with precise quantitative and qualitative performance targets, to allow effective monitoring and enable corrective actions to be taken when agreed service levels are not met."]
["Third Party Risk Management","Notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions.",30,"(b)","Notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions."]
["Third Party Risk Management","Requirements for the ICT third-party service provider to implement and test business contingency plans and have in place ICT security measures, tools, and policies that provide an appropriate level of security for the provision of services in line with the financial entity's regulatory framework.",30,"(c)","Requirements for the ICT third-party service provider to implement and test business contingency plans and have in place ICT security measures, tools, and policies that provide an appropriate level of security for the provision of services in line with the financial entity's regulatory framework."]
["Third Party Risk Management","The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27.",30,"(d)","The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27."]
["Third Party Risk Management","The right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, including unrestricted rights of access, inspection, and audit by the financial entity or an appointed third party, and the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by competent authorities, the Lead Overseer, financial entity, or an appointed third party. The right to agree on alternative assurance levels if other clients' rights are affected, and the obligation to provide details on the scope, procedures, and frequency of such inspections and audits.",30,"(e)","The right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, including unrestricted rights of access, inspection, and audit by the financial entity or an appointed third party, and the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by competent authorities, the Lead Overseer, financial entity, or an appointed third party. The right to agree on alternative assurance levels if other clients' rights are affected, and the obligation to provide details on the scope, procedures, and frequency of such inspections and audits."]
["Third Party Risk Management","Exit strategies, including the establishment of a mandatory adequate transition period, during which the ICT third-party service provider will continue providing the respective functions or ICT services, allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.\n(i) during which the ICT third-party service provider will continue providing the \nrespective functions, or ICT services, with a view to reducing the risk of \ndisruption at the financial entity or to ensure its effective resolution and \nrestructuring;\n(ii) allowing the financial entity to migrate to another ICT third-party service \nprovider or change to in-house solutions consistent with the complexity of the \nservice provided.",30,"(f)","Exit strategies, including the establishment of a mandatory adequate transition period, during which the ICT third-party service provider will continue providing the respective functions or ICT services, allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.\n(i) during which the ICT third-party service provider will continue providing the \nrespective functions, or ICT services, with a view to reducing the risk of \ndisruption at the financial entity or to ensure its effective resolution and \nrestructuring;\n(ii) allowing the financial entity to migrate to another ICT third-party service \nprovider or change to in-house solutions consistent with the complexity of the \nservice provided."]
["Third Party Risk Management","The organization should ensure to consider to use standard contractual clauses developed for the specific services ",30,4,"When negotiating contractual arrangements, financial entities and ICT third-party service \nproviders shall consider the use of standard contractual clauses developed by public \nauthorities for specific services."]

{"sheet":"Third Party Risk Mangement","index":7,"n_rows":48,"n_cols":12,"rows_kept":48,"cut":false,"hidden":false,"merged":[]}
[0]
[]
[]
[null,null,null,null,null,"You can use the filter box to find specific sections by using phrases like \"Business Continuity\" or \"Cyber Security\""]
[null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks "]
[null,"Third Party Risk Management","Does the organization manage ICT third party risk as an integrated part of the overall ICT risk management framework?",28,1,"1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk \nwithin their ICT risk management framework as referred to in Article 6(1), and in \naccordance with the following principles:"]
[null,"Third Party Risk Management","Is the organization acting as responsible for all service providers running business operations?",28,1,"(a) financial entities that have in place contractual arrangements for the use of ICT \nservices to run their business operations shall, at all times, remain fully responsible \nfor compliance with, and the discharge of, all obligations under this Regulation and \napplicable financial services law;"]
[null,"Third Party Risk Management","Is ICT third party risk implemented in light of the principle of proportionality taking into account the nature, scale, complexity and importance of ICT-related dependencies?",28,1,"financial entities’ management of ICT third-party risk shall be implemented in light \nof the principle of proportionality, taking into account:\n(i) the nature, scale, complexity and importance of ICT-related dependencies,\n(ii) the risks arising from contractual arrangements on the use of ICT services \nconcluded with ICT third-party service providers, taking into account the \ncriticality or importance of the respective service, process or function, and the \npotential impact on the continuity and availability of financial services and \nactivities, at individual and at group level"]
[null,"Third Party Risk Management","Is ICT third party risk implemented in light of the principle of proportionality taking into account the risks arising from contractual arrangements on the use of ICT services done by ICT third party service providers, especially with regards to criticality or important service, process, or function with regard to the continuity and availability of financial services and activities?",28,1,"financial entities’ management of ICT third-party risk shall be implemented in light \nof the principle of proportionality, taking into account:\n(i) the nature, scale, complexity and importance of ICT-related dependencies,\n(ii) the risks arising from contractual arrangements on the use of ICT services \nconcluded with ICT third-party service providers, taking into account the \ncriticality or importance of the respective service, process or function, and the \npotential impact on the continuity and availability of financial services and \nactivities, at individual and at group level"]
[null,"Third Party Risk Management","As part of the ICT risk management, organizations should maintain and update a database related to all contractual arrangements on the use of the ICT services provided by ICT third party?",28,1,"As part of their ICT risk management framework, financial entities shall maintain and \nupdate at entity level, and at sub-consolidated and consolidated levels, a register of \ninformation in relation to all contractual arrangements on the use of ICT services provided \nby ICT third-party service providers."]
[null,"Third Party Risk Management","Has the organization adapted and yearly reviewed a strategy on ICT third-party risk taking into account a multi-vendor strategy?",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions.","Other than microenterprises"]
[null,"Third Party Risk Management","Does the above-mentioned strategy provide a policy for vendors serving critical or important functions?",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions.","Other than microenterprises"]
[null,"Third Party Risk Management","Does the organization conduct an overall risk profile based on third-party risk?",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions.","Other than microenterprises"]
[null,"Third Party Risk Management","Does the organization maintain a register of all information related to ICT third-party service providers, both sub-consolidated and consolidated?",28,3,"As part of their ICT risk management framework, financial entities shall maintain and \nupdate at entity level, and at sub-consolidated and consolidated levels, a register of \ninformation in relation to all contractual arrangements on the use of ICT services provided \nby ICT third-party service providers"]
[null,"Third Party Risk Management","Are all contractual arrangements documented, and those supporting critical or important services distinguished?",28,3,"The contractual arrangements referred to in the first subparagraph shall be appropriately \ndocumented, distinguishing between those that cover ICT services supporting critical or \nimportant functions and those that do not."]
[null,"Third Party Risk Management","Does the organization report regularly to competent authorities on the services provided, at least yearly?",28,3,"Financial entities shall report at least yearly to the competent authorities on the number of \nnew arrangements on the use of ICT services, the categories of ICT third-party service \nproviders, the type of contractual arrangements and the ICT services and functions which \nare being provided."]
[null,"Third Party Risk Management","Does the organization have the capability to share information with competent authorities upon request?",28,3,"Financial entities shall make available to the competent authority, upon its request, the full \nregister of information or, as requested, specified sections thereof, along with any \ninformation deemed necessary to enable the effective supervision of the financial entity."]
[null,"Third Party Risk Management","Does the organization have the capability to inform authorities in a timely manner about any planned contractual arrangements supporting critical or important functions?",28,3,"Financial entities shall inform the competent authority in a timely manner about any \nplanned contractual arrangement on the use of ICT services supporting critical or important \nfunctions as well as when a function has become critical or important."]
[null,"Third Party Risk Management","Does the organization, before entering into a contractual arrangement for ICT services, ensure: \n(a) the arrangement covers the use of ICT services supporting a critical or important function; \n(b) supervisory conditions for contracting are met; \n(c) relevant risks are identified and assessed, including the possibility of reinforcing ICT concentration risk; \n(d) all due diligence is undertaken on prospective ICT third-party service providers to ensure suitability; (e) conflicts of interest are identified and assessed?",28,4,"Before entering into a contractual arrangement on the use of ICT services, financial entities \nshall:\n(a) assess whether the contractual arrangement covers the use of ICT services supporting \na critical or important function;\n(b) assess if supervisory conditions for contracting are met;\n(c) identify and assess all relevant risks in relation to the contractual arrangement, \nincluding the possibility that such contractual arrangement may contribute to \nreinforcing ICT concentration risk as referred to in Article 29;\n(d) undertake all due diligence on prospective ICT third-party service providers and \nensure throughout the selection and assessment processes that the ICT third-party \nservice provider is suitable;\n(e) identify and assess conflicts of interest that the contractual arrangement may cause"]
[null,"Third Party Risk Management","Does the organization ensure that all ICT third-parties they enter into agreement with comply with appropriate information security standards?",28,5,"Financial entities may only enter into contractual arrangements with ICT third-party \nservice providers that comply with appropriate information security standards. When those \ncontractual arrangements concern critical or important functions, financial entities shall, \nprior to concluding the arrangements, take due consideration of the use, by ICT third-party \nservice providers, of the most up-to-date and highest quality information \nsecurity standards."]
[null,"Third Party Risk Management","Does the organization have exercise access, inspection and audit rights over the ICT third-party service provider? Does the organization use a risk-based approach to pre-determine the frequency of audits and inspections?",28,6,"In exercising access, inspection and audit rights over the ICT third-party service provider, \nfinancial entities shall, on the basis of a risk-based approach, pre-determine the frequency \nof audits and inspections as well as the areas to be audited through adhering to commonly \naccepted audit standards in line with any supervisory instruction on the use and \nincorporation of such audit standards."]
[null,"Third Party Risk Management","Does the organization ensure that all inspectors and auditors possess the necessary skills?",28,6,"Where contractual arrangements concluded with ICT third-party service providers on the \nuse of ICT services entail high technical complexity, the financial entity shall verify that \nauditors, whether internal or external, or a pool of auditors, possess appropriate skills and \nknowledge to effectively perform the relevant audits and assessments."]
[null,"Third Party Risk Management","Does the organization ensure that it has the right to terminate contracts in the event of the following: (a) significant breach by the ICT third-party service provider of applicable laws, regulations, or contractual terms; (b) circumstances identified throughout the monitoring of ICT third-party risk that are deemed capable of altering the performance of the functions provided through the contractual arrangement, including material changes that affect the arrangement or the situation of the ICT third-party service provider; (c) ICT third-party service provider's evidenced weaknesses pertaining to its overall ICT risk management and, in particular, the way it ensures the availability, authenticity, integrity, and confidentiality of data, whether personal or otherwise sensitive data, or non-personal data; (d) where the competent authority can no longer effectively supervise the financial entity as a result of the conditions of or circumstances related to the respective contractual arrangement?",28,7,"7. Financial entities shall ensure that contractual arrangements on the use of ICT services \nmay be terminated in any of the following circumstances:\n(a) significant breach by the ICT third-party service provider of applicable laws, \nregulations or contractual terms;\n(b) circumstances identified throughout the monitoring of ICT third-party risk that are \ndeemed capable of altering the performance of the functions provided through the \ncontractual arrangement, including material changes that affect the arrangement or \nthe situation of the ICT third-party service provider;\n(c) ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT \nrisk management and in particular in the way it ensures the availability, authenticity, \nintegrity and, confidentiality, of data, whether personal or otherwise sensitive data, or \nnon-personal data;\n(d) where the competent authority can no longer effectively supervise the financial entity \nas a result of the conditions of, or circumstances related to, the respective contractual \narrangement."]
[null,"Third Party Risk Management","Does the organization have exit strategies for all service providers who provide services to critical or important functions?",28,8,"or ICT services supporting critical or important functions, financial entities shall put in \nplace exit strategies. The exit strategies shall take into account risks that may emerge at the \nlevel of ICT third-party service providers, in particular a possible failure on their part, a \ndeterioration of the quality of the ICT services provided, any business disruption due to \ninappropriate or failed provision of ICT services or any material risk arising in relation to \nthe appropriate and continuous deployment of the respective ICT service, or the \ntermination of contractual arrangements with ICT third-party service providers under any \nof the circumstances listed in paragraph 7.\nFinancial entities shall ensure that they are able to exit contractual arrangements without:\n(a) disruption to their business activities,\n(b) limiting compliance with regulatory requirements,\n(c) detriment to the continuity and quality of services provided to clients.\nExit plans shall be comprehensive, documented and, in accordance with the criteria set out \nin Article 4(2), shall be sufficiently tested and reviewed periodically\nFinancial entities shall identify alternative solutions and develop transition plans enabling \nthem to remove the contracted ICT services and the relevant data from the ICT third-party \nservice provider and to securely and integrally transfer them to alternative providers or \nreincorporate them in-house.\nFinancial entities shall have appropriate contingency measures in place to maintain \nbusiness continuity in the event of the circumstances referred to in the first subparagraph."]
[null,"Third Party Risk Management","Does the organization have alternative plans for the aforementioned service providers who provide services to critical or important functions?",28,8,"Financial entities shall identify alternative solutions and develop transition plans enabling \nthem to remove the contracted ICT services and the relevant data from the ICT third-party \nservice provider and to securely and integrally transfer them to alternative providers or \nreincorporate them in-house."]
[null,"Third Party Risk Management","Does the organization have contingency and business continuity plans in place for those service providers?",28,8,"Financial entities shall have appropriate contingency measures in place to maintain \nbusiness continuity in the event of the circumstances referred to in the first subparagraph."]
[null,"Third Party Risk Management","Does the organization have measures in place to ensure that service providers who provide critical or important functions are not too difficult to replace, or that individual service providers have multiple contractual arrangements, thus preventing the organization from becoming too reliant on them?",29,1," When performing the identification and assessment of risks referred to in Article 28(4), \npoint (c), financial entities shall also take into account whether the envisaged conclusion of \na contractual arrangement in relation to ICT services supporting critical or important \nfunctions would lead to any of the following:\n(a) contracting an ICT third-party service provider that is not easily substitutable; or\n(b) having in place multiple contractual arrangements in relation to the provision of ICT \nservices supporting critical or important functions with the same ICT third-party \nservice provider or with closely connected ICT third-party service providers.\nFinancial entities shall weigh the benefits and costs of alternative solutions, such as the use \nof different ICT third-party service providers, taking into account if and how envisaged \nsolutions match the business needs and objectives set out in their digital resilience strategy."]
[null,"Third Party Risk Management","Does the organization have measures in place to assess the risk of subcontractors of a service provider who provide critical or important functions, particularly if the subcontractor is in a third country?",29,2,"Where the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third\u0002party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country."]
[null,"Third Party Risk Management","If the service provider is located in a third country, the organization should be aware of the insolvency law provisions that apply in the event of the service providers bankruptcy?",29,2,"Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity’s data."]
[null,"Third Party Risk Management","If the service provider is located in a third country, the organization should be aware of the risks associated with data protection?",29,2,"Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country."]
[null,"Third Party Risk Management","Organizations should consider if long and complex sub-contractor networks may effect the way the organization can monitor the service provider?",29,2,"Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively \nsupervise the financial entity in that respect."]
[null,"Third Party Risk Management","Does the organization ensure that the right and obligations of the financial entity and the ICT third party is allocated in writing and the full contract should be documented in one written document available to both parties?",30,1,"The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format."]
[null,"Third Party Risk Management","Does the organization have a  clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting?",30,"2a","(a) a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting;"]
[null,"Third Party Risk Management","Does the organization require the ICT third-party service provider to disclose the regions or countries where they will provide contracted or subcontracted functions and ICT services, and where data will be processed and stored? Are there provisions in place to ensure that the provider notifies the organization in advance of any changes to these locations?",30,"2b","The locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations."]
[null,"Third Party Risk Management","Are there provisions in place to ensure data protection, including personal data, with regards to availability, authenticity, integrity and confidentiality?",30,"2c","Provisions on availability, authenticity, integrity, and confidentiality for data protection, including personal data."]
[null,"Third Party Risk Management","Are there provisions in place to ensure access, recovery, and return of personal and non-personal data in case of the ICT third-party service provider's insolvency, resolution, discontinuation of business operations, or termination of the contractual arrangement?",30,"2d","Provisions for ensuring access, recovery, and return of personal and non-personal data in the event of the ICT third-party service provider's insolvency, resolution, or discontinuation of business operations or termination of the contractual arrangement."]
[null,"Third Party Risk Management","Are there service level descriptions in place, including updates and revisions thereof?",30,"2e","Service level descriptions, including updates and revisions thereof."]
[null,"Third Party Risk Management","Does the ICT third-party service provider have an obligation to assist the financial entity at no additional cost or at a cost that is determined ex-ante in the event of an ICT incident related to the ICT service provided to the financial entity?",30,"2f","Obligation of the ICT third-party service provider to provide assistance to the financial entity, at no additional cost, or at a cost that is determined ex-ante, in case of an ICT incident related to the ICT service provided to the financial entity."]
[null,"Third Party Risk Management","Does the ICT third-party service provider have an obligation to fully cooperate with the competent authorities and resolution authorities of the financial entity, including persons appointed by them?",30,"2g","Obligation of the ICT third-party service provider to fully cooperate with the competent authorities and resolution authorities of the financial entity, including persons appointed by them."]
[null,"Third Party Risk Management","Are there termination rights and related minimum notice periods in place for the termination of the contractual arrangement, in accordance with the expectations of competent authorities and resolution authorities?",30,"2h","Termination rights and related minimum notice periods for the termination of the contractual arrangement, in accordance with the expectations of competent authorities and resolution authorities."]
[null,"Third Party Risk Management","Does the organization use these elements when writing contractual arrangements on the use of ICT services supporting critical or important functions which shall include, in addition to the elements referred to in paragraph 2, at least the following:",30,3,"The contractual arrangements on the use of ICT services supporting critical or important functions shall include, in addition to the elements referred to in paragraph 2, at least the following:"]
[null,"Third Party Risk Management","Does the orgnisations ICT services include: Full service level descriptions, including updates and revisions with precise quantitative and qualitative performance targets, to allow effective monitoring and enable corrective actions to be taken when agreed service levels are not met.",30," (a)","The full service level descriptions, including updates and revisions with precise quantitative and qualitative performance targets, to allow effective monitoring and enable corrective actions to be taken when agreed service levels are not met."]
[null,"Third Party Risk Management","Does the orgnisations ICT services include: Notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions.",30,"(b)","Notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions."]
[null,"Third Party Risk Management","Does the orgnisations ICT services include: Requirements for the ICT third-party service provider to implement and test business contingency plans and have in place ICT security measures, tools, and policies that provide an appropriate level of security for the provision of services in line with the financial entity's regulatory framework.",30,"(c)","Requirements for the ICT third-party service provider to implement and test business contingency plans and have in place ICT security measures, tools, and policies that provide an appropriate level of security for the provision of services in line with the financial entity's regulatory framework."]
[null,"Third Party Risk Management","Does the orgnisations ICT services include: The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27.",30,"(d)","The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27."]
[null,"Third Party Risk Management","Does the orgnisations ICT services include: The right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, including unrestricted rights of access, inspection, and audit by the financial entity or an appointed third party, and the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by competent authorities, the Lead Overseer, financial entity, or an appointed third party. The right to agree on alternative assurance levels if other clients' rights are affected, and the obligation to provide details on the scope, procedures, and frequency of such inspections and audits.",30,"(e)","The right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, including unrestricted rights of access, inspection, and audit by the financial entity or an appointed third party, and the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by competent authorities, the Lead Overseer, financial entity, or an appointed third party. The right to agree on alternative assurance levels if other clients' rights are affected, and the obligation to provide details on the scope, procedures, and frequency of such inspections and audits."]
[null,"Third Party Risk Management","Does the orgnisations ICT services include: Exit strategies, including the establishment of a mandatory adequate transition period, during which the ICT third-party service provider will continue providing the respective functions or ICT services, allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.\n(i) during which the ICT third-party service provider will continue providing the \nrespective functions, or ICT services, with a view to reducing the risk of \ndisruption at the financial entity or to ensure its effective resolution and \nrestructuring;\n(ii) allowing the financial entity to migrate to another ICT third-party service \nprovider or change to in-house solutions consistent with the complexity of the \nservice provided.",30,"(f)","Exit strategies, including the establishment of a mandatory adequate transition period, during which the ICT third-party service provider will continue providing the respective functions or ICT services, allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.\n(i) during which the ICT third-party service provider will continue providing the \nrespective functions, or ICT services, with a view to reducing the risk of \ndisruption at the financial entity or to ensure its effective resolution and \nrestructuring;\n(ii) allowing the financial entity to migrate to another ICT third-party service \nprovider or change to in-house solutions consistent with the complexity of the \nservice provided."]
[null,"Third Party Risk Management","Does the organization use standard contractual clauses developed by public authorities when making a contract for specific services? ",30,4,"When negotiating contractual arrangements, financial entities and ICT third-party service \nproviders shall consider the use of standard contractual clauses developed by public \nauthorities for specific services."]

{"sheet":"Questionnaire","index":8,"n_rows":114,"n_cols":8,"rows_kept":114,"cut":false,"hidden":true,"merged":[]}
[]
[]
[null,null,"Key Area ","ICT Risk management ",null,"Kontoller som är delvist/inte uppfyllnad"]
[null,null,"Ja",{"$f":"+COUNTIF(#REF!,Sheet2!$B$3)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B11","v":"Information-sharing arrangements on cyber threat information and intelligence"}]
[null,null,"Delvist ",{"$f":"+COUNTIF(#REF!,Sheet2!$B$4)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B12","v":"ICT Risk management Framework is established"}]
[null,null,"Nej",{"$f":"+COUNTIF(#REF!,Sheet2!$B$5)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B13","v":"IT tools and systems to minize ICT Risk "}]
[null,null,"Key Area ","ICT Incident Reporting and management ",null,{"$f":"Tasks!$B14","v":"Business continuity plans for all processes involving "}]
[null,null,"Ja",{"$f":"+COUNTIF(#REF!,Sheet2!$B$3)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B15","v":"Disaster Recovery plans for all Critical and Important systems "}]
[null,null,"Delvist ",{"$f":"+COUNTIF(#REF!,Sheet2!$B$4)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B16","v":"Establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents"}]
[null,null,"Nej",{"$f":"+COUNTIF(#REF!,Sheet2!$B$5)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B17","v":"Reporting of major ICT-related incidents"}]
[null,null,"Key Area ","Digitial Testing and Exercising",null,{"$f":"Tasks!$B18","v":"General requirements for the performance of digital operational resilience testing"}]
[null,null,"Ja",{"$f":"+COUNTIF(#REF!,Sheet2!$B$3)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B19","v":"Advanced testing of ICT tools, systems and processes based on threat led penetration testing"}]
[null,null,"Delvist ",{"$f":"+COUNTIF(#REF!,Sheet2!$B$4)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B20","v":" Requirements for testers"}]
[null,null,"Nej",{"$f":"+COUNTIF(#REF!,Sheet2!$B$5)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B21","v":"Preliminary assessment of ICT concentration risk and further sub-outsourcing arrangements"}]
[null,null,"Key Area ","ICT Third-party Management",null,{"$f":"Tasks!$B22","v":"Key contractual provisions"}]
[null,null,"Ja",{"$f":"+COUNTIF(#REF!,Sheet2!$B$3)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B23","v":0}]
[null,null,"Delvist ",{"$f":"+COUNTIF(#REF!,Sheet2!$B$4)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B24","v":0}]
[null,null,"Nej",{"$f":"+COUNTIF(#REF!,Sheet2!$B$5)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B25","v":0}]
[null,null,"Key Area ","Information Sharing Arrangements",null,{"$f":"Tasks!$B26","v":0}]
[null,null,"Ja",{"$f":"+COUNTIF(#REF!,Sheet2!$B$3)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B27","v":0}]
[null,null,"Delvist ",{"$f":"+COUNTIF(#REF!,Sheet2!$B$4)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B28","v":0}]
[null,null,"Nej",{"$f":"+COUNTIF(#REF!,Sheet2!$B$5)","v":{"$error":"#REF!"}},null,{"$f":"Tasks!$B29","v":0}]
[null,null,null,null,null,{"$f":"Tasks!$B30","v":0}]
[null,null,null,null,null,{"$f":"Tasks!$B31","v":0}]
[]
[]
[null,null,"ICT Risk management "]
[null,null,"Kontroll","Kontrollbevis ","För stöd, se \nvägledning \navsnitt","Uppfyllnad av kontroll Ja/Delvis/Nej ","% uppfyllt","Kommentar/åtgärd"]
[null,null,"ICT Risk management Framework is established","Your entity have a comprehensive ICT risk management framework that enables you to address ICT risks quickly and accurately?\n\nIt include strategies, policies, procedures, protocols, and tools to protect physical components and infrastructures, like computer hardware and servers?\n\nThe framework is documented and reviewed regularly, audited by ICT auditors, and include a digital resilience strategy setting out how the framework is implemented?\n\nIt is also include communication strategies in case of ICT-related incidents? ",null,"Delvist ",0.9]
[null,null,"IT tools and systems to minize ICT Risk ","Your entity ensure that the internal ICT systems, protocols, and tools are reliable, appropriate for your operations, and equipped with the necessary capacity to process data in a timely manner? ",null,"Delvist ",0.75]
[null,null,"Identification of ICT risks","Your entity ensure conducting ICT risk assessments?\n\nYour entity are identifying, classifying, documenting and reviewing business functions, information assets, ICT system configurations and interconnections? \n\nYour entity also identify and document any processes reliant on third-party service providers and maintain inventories?\n\nYour entity perform a yearly risk assessment on legacy systems?",null,"Ja ",1]
[null,null,"Detection systems and processes ","Your entity has established systems to detect ICT network performance issues, ICT-related incidents, and single points of failure?\n\nThese systems are regularly tested and have multiple layers of control and alert thresholds in place? \n\nAdditionally, your entity allocates resources to monitor user activity, ICT anomalies, and cyber-attacks?\n\nLastly, there are systems in place to check trade reports for accuracy and request re-transmission of faulty reports?",null,"Ja ",1]
[null,null,"Business continuity plans for all processes involving ","Your entity have in place a comprehensive ICT Business Continuity Policy and associated ICT Disaster Recovery Plan as part of your risk management framework? \n\nThese policies include arrangements, plans, procedures and mechanisms to record, respond to, and resolve ICT-related incidents, as well as communication and crisis management actions?\n\nYour entity test the ICT Business Continuity Policy and ICT Disaster Recovery Plan yearly and after substantive changes, and have a crisis management function in case of activation?\n\nRecords of activities before and during disruption events is also  kept?",null,"Delvist ",0.5]
[null,null,"Disaster Recovery plans for all Critical and Important systems ","Your entity has a comprehensive backup and recovery policy in place to ensure that ICT systems can be restored with minimal disruption and downtime?\n\nBackup systems are activated quickly, and if they are self-hosted, they  run in a secure, separate environment?\n\nYour entity also maintains redundant ICT capacities, and if specified, they have a secondary processing site located at a different geographical distance to ensure the same level of services, and is immediately accessible?\n\nRecovery time and point objectives consider any potential market impact, and multiple checks are conducted to verify data integrity when recovering from an ICT-related incident?",null,"Nej ",0.1]
[null,null,null,null,null,"Nej "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"ICT Incident Reporting and management "]
[null,null,"Kontroll","Kontrollbevis ","För stöd, se \nvägledning \navsnitt","Uppfyllnad av kontroll Ja/Delvis/Nej ","% till  at ha uppfyllnad av kontrol fullt","Kommentar/åtgärd"]
[null,null,"Establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents","\nYour entity has taken the necessary steps to ensure your ICT-related incident management process is effective?\n\nYou have established roles and responsibilities for different incident types and scenarios? \n\nYou have plans for communication and notification for major incidents? \n\nYou have also established response procedures to mitigate impacts and put in place early warning indicators as alerts?",null,"Delvist ",0.6]
[null,null,"Classification of ICT-related incidents","\n\nYour entity classify ICT-related incidents based on criteria like user count, duration, data losses, severity of impact, and economic impact?",null,"Ja ",1]
[null,null,"Reporting of major ICT-related incidents","\n\nYour entity inform your service users, submit initial, intermediate and final reports to the relevant competent authority?\n\nYour entity delegate the reporting obligations to a third-party service provider with approval?",null,"Nej ",0.3]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"Digitial Testing and Exercising"]
[null,null,"Kontroll","Kontrollbevis ","För stöd, se \nvägledning \navsnitt","Uppfyllnad av kontroll Ja/Delvis/Nej ","% till  at ha uppfyllnad av kontrol fullt","Kommentar/åtgärd"]
[null,null,"General requirements for the performance of digital operational resilience testing","Your entity have established and reviewed a digital operational resilience testing programme as part of your ICT risk management framework. This program include risk-based assessments, tests, methodologies, practices and tools. Finally, all critical ICT systems and applications are tested by a third-party actor   at least once a year.",null,"Delvist ",0.5]
[null,null,"Testing of ICT tools and systems","Your entity test  digital operational resilience, which include vulnerability assessments, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires, scanning software solutions, source code reviews, scenario-based tests, compatibility testing, performance testing, and end-to-end or penetration testing.",null,"Ja ",1]
[null,null,"Advanced testing of ICT tools, systems and processes based on threat led penetration testing","Yoru entity carry out threat led penetration testing at least every 3 years to cover at least the critical functions and services of your organization. The testing is  performed on live production systems, and any ICT third-party service providers are included in the scope. ",null,"Delvist ",0.75]
[null,null," Requirements for testers","Your entity only use highly qualified and reputable testers for threat-led penetration testing, who are certified by a professional body and have the necessary technical and organizational capabilities. The external testers  have appropriate professional indemnity insurance, and your agreements must cover the sound management of penetration testing results, including the proper protection of confidential information and any processing of the results.",null,"Delvist ",0.6]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"ICT Third-party Risk Management"]
[null,null,"Kontroll","Kontrollbevis ","För stöd, se \nvägledning \navsnitt","Uppfyllnad av kontroll Ja/Delvis/Nej ","% till  at ha uppfyllnad av kontrol fullt","Kommentar/åtgärd"]
[null,null,"General requirements and principles","Your entity manage ICT third-party risk as an integral component of your ICT risk management framework and in accordance with outlined principles. These principles include the responsibility of contractual arrangements, the adoption and regular review of a strategy on ICT third-party risk, the maintenance and updating of a Register of Information, and the assessment of risks prior to entering into a contractual arrangement. ",null,"Ja ",1]
[null,null,"Preliminary assessment of ICT concentration risk and further sub-outsourcing arrangements","Your entity assess the risks of ICT concentration when contracting with an ICT third-party service provider. This includes looking at the possibility of sub-contracting and weighing the benefits and costs of different solutions. Factors to consider include data protection, enforcement of law, insolvency law provisions, and the ability to recover data. Your entity also assess how long or complex chains of sub-contracting may impact your ability to monitor the contracted functions and the effectiveness of the competent authority's supervision.",null,"Delvist ",0.5]
[null,null,"Key contractual provisions","\nYour entity have contractual arrangements including the description of functions and services to be provided, the locations where data is to be processed, accessibility and availability, service level descriptions, reporting obligations, and termination rights. ",null,"Nej ",0.05]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"Information Sharing Arrangements"]
[null,null,"Kontroll","Kontrollbevis ","För stöd, se \nvägledning \navsnitt","Uppfyllnad av kontroll Ja/Delvis/Nej ","% till  at ha uppfyllnad av kontrol fullt","Kommentar/åtgärd"]
[null,null,"Information-sharing arrangements on cyber threat information and intelligence","Your entity exchange cyber threat information and intelligence with other entities in order to enhance your digital operational resilience. The information-sharing arrangements are conducted in a trusted community, with rules in place to protect the sensitivity of the information shared, and is  overseen by public authorities. Your entity also notify competent authorities when joining or leaving the information-sharing arrangements.",null,"Nej ",0]
[null,null,null,null,null,"Delvist ",0.15]

{"sheet":"Do not Touch","index":9,"n_rows":3,"n_cols":61,"rows_kept":3,"cut":false,"hidden":false,"merged":[]}
["Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks ",null,null,null,null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks ",null,null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks ",null,null,null,null,null,null,null,null,null,null,null,"Topic ","Question","Article  ","Section","DORA Text \n(subset of DORA text in relation to the question) ","Requirements for specific companies ","Do you meet the requirements today?","% requirements meet","Priority","Effort level \n(How much effort will it take to implement) ","Comments/Tasks "]
["ICT Risk management ","Does your organization have an internal governance and control framework in place to ensure effective and prudent management of ICT risk?",5,1,"Financial entities shall have in place an internal governance and control framework that \nensures an effective and prudent management of ICT risk, in accordance with Article 6(4), \nin order to achieve a high level of digital operational resilience."," ","Partly",null,3,"High Effort ",null,null,null,null,null,"ICT-related incident management, classification and reporting","Does the organization define, establish and implement an incident management process for ICT-related incidents to detect, manage, and notify them?",17,1,"Financial entities shall define, establish and implement an ICT-related incident \nmanagement process to detect, manage and notify ICT-related incidents.",null,"Partly",null,4,null,null,null,null,"Digital operational resilience testing","Does your organization establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of the ICT risk-management framework referred to in Article 6?",24,1,"For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.","other than microenterprises","Partly",null,3,"Low effort ",null,null,null,null,null,null,null,null,null,null,null,null,"Third Party Risk Management","Does the organization manage ICT third party risk as an integrated part of the overall ICT risk management framework?",28,1,"1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk \nwithin their ICT risk management framework as referred to in Article 6(1), and in \naccordance with the following principles:",null,"Partly",null,null,"Medium Effort "]
["ICT Risk management ","Does your management body define, oversee and take responsibility for the ICT risk management framework?",5,2,"The management body of the financial entity shall define, approve, oversee and be \nresponsible for the implementation of all arrangements related to the ICT risk management \nframework referred to in Article 6(1).",null,"No",null,4,null,null,null,null,null,null,"ICT-related incident management, classification and reporting","Does the organization record all ICT-related incidents and significant cyber threats?",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.",null,"No",null,null,null,null,null,null,"Digital operational resilience testing","Does the organization's program include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26?",24,2,"The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26.",null,"No",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Third Party Risk Management","Is the organization acting as responsible for all service providers running business operations?",28,1,"(a) financial entities that have in place contractual arrangements for the use of ICT \nservices to run their business operations shall, at all times, remain fully responsible \nfor compliance with, and the discharge of, all obligations under this Regulation and \napplicable financial services law;",null,"No"]

{"sheet":"Tasks","index":10,"n_rows":22,"n_cols":7,"rows_kept":22,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Kontroll","Kontrollbevis ","För stöd, se \nvägledning \navsnitt","Uppfyllnad av kontroll Ja/Delvis/Nej ","% till  at ha uppfyllnad av kontrol fullt","Kommentar/åtgärd"]
[null,"Information-sharing arrangements on cyber threat information and intelligence","Your entity exchange cyber threat information and intelligence with other entities in order to enhance your digital operational resilience. The information-sharing arrangements are conducted in a trusted community, with rules in place to protect the sensitivity of the information shared, and is  overseen by public authorities. Your entity also notify competent authorities when joining or leaving the information-sharing arrangements.",null,"Nej ",0]
[null,"ICT Risk management Framework is established","Your entity have a comprehensive ICT risk management framework that enables you to address ICT risks quickly and accurately. It  include strategies, policies, procedures, protocols, and tools to protect physical components and infrastructures, like computer hardware and servers. The framework should be documented and reviewed regularly, audited by ICT auditors, and include a digital resilience strategy setting out how the framework is implemented. It should also include communication strategies in case of ICT-related incidents. ",null,"Delvist ",0.5]
[null,"IT tools and systems to minize ICT Risk ","Your entity ensure that the internal ICT systems, protocols, and tools are reliable, appropriate for your operations, and equipped with the necessary capacity to process data in a timely manner. ",null,"Delvist ",0.75]
[null,"Business continuity plans for all processes involving ","Your entity have in place a comprehensive ICT Business Continuity Policy and associated ICT Disaster Recovery Plan as part of your risk management framework. These policies should include arrangements, plans, procedures and mechanisms to record, respond to, and resolve ICT-related incidents, as well as communication and crisis management actions. Your entity test the ICT Business Continuity Policy and ICT Disaster Recovery Plan yearly and after substantive changes, and have a crisis management function in case of activation. Records of activities before and during disruption events is also  kept. ",null,"Delvist ",0.5]
[null,"Disaster Recovery plans for all Critical and Important systems ","Your entity has a comprehensive backup and recovery policy in place to ensure that ICT systems can be restored with minimal disruption and downtime. Backup systems must be activated quickly, and if they are self-hosted, they must run in a secure, separate environment. Your entity also maintains redundant ICT capacities, and if specified, must have a secondary processing site located at a different geographical distance to ensure the same level of services, and it must be immediately accessible. Recovery time and point objectives must consider any potential market impact, and multiple checks must be conducted to verify data integrity when recovering from an ICT-related incident.",null,"Nej ",0.1]
[null,"Establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents","\nYour entity has taken the necessary steps to ensure your ICT-related incident management process is effective. You have established roles and responsibilities for different incident types and scenarios, as well as plans for communication and notification for major incidents. You have also established response procedures to mitigate impacts and put in place early warning indicators as alerts.",null,"Delvist ",0.6]
[null,"Reporting of major ICT-related incidents","\n\nYour entity inform your service users, submit initial, intermediate and final reports to the relevant competent authority, and may delegate their reporting obligations to a third-party service provider with approval. ",null,"Nej ",0.3]
[null,"General requirements for the performance of digital operational resilience testing","Your entity have established and reviewed a digital operational resilience testing programme as part of your ICT risk management framework. This program include risk-based assessments, tests, methodologies, practices and tools. Finally, all critical ICT systems and applications are tested by a third-party actor   at least once a year.",null,"Delvist ",0.5]
[null,"Advanced testing of ICT tools, systems and processes based on threat led penetration testing","Yoru entity carry out threat led penetration testing at least every 3 years to cover at least the critical functions and services of your organization. The testing is  performed on live production systems, and any ICT third-party service providers are included in the scope. ",null,"Delvist ",0.75]
[null," Requirements for testers","Your entity only use highly qualified and reputable testers for threat-led penetration testing, who are certified by a professional body and have the necessary technical and organizational capabilities. The external testers  have appropriate professional indemnity insurance, and your agreements must cover the sound management of penetration testing results, including the proper protection of confidential information and any processing of the results.",null,"Delvist ",0.6]
[null,"Preliminary assessment of ICT concentration risk and further sub-outsourcing arrangements","Your entity assess the risks of ICT concentration when contracting with an ICT third-party service provider. This includes looking at the possibility of sub-contracting and weighing the benefits and costs of different solutions. Factors to consider include data protection, enforcement of law, insolvency law provisions, and the ability to recover data. Your entity also assess how long or complex chains of sub-contracting may impact your ability to monitor the contracted functions and the effectiveness of the competent authority's supervision.",null,"Delvist ",0.5]
[null,"Key contractual provisions","\nYour entity have contractual arrangements including the description of functions and services to be provided, the locations where data is to be processed, accessibility and availability, service level descriptions, reporting obligations, and termination rights. ",null,"Nej ",0.05]

{"sheet":"Sheet2","index":11,"n_rows":7,"n_cols":6,"rows_kept":7,"cut":false,"hidden":true,"merged":[]}
[]
[]
[null,"Yes",null,1,null,"Low effort "]
[null,"Partly",null,2,null,"Medium Effort "]
[null,"No",null,3,null,"High Effort "]
[null,null,null,4]
[null,null,null,5]

{"sheet":"Sheet7","index":12,"n_rows":267,"n_cols":10,"rows_kept":267,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[null,"Topic ","Question","Article  ","Section","DORA Text ","Do you meet the requirements today?","% requirements meet","Priority","Comments/Tasks "]
[null,"ICT Risk management ","Does your financial entity have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk",5,1,"Financial entities shall have in place an internal governance and control framework that \nensures an effective and prudent management of ICT risk, in accordance with Article 6(4), \nin order to achieve a high level of digital operational resilience.","Partly",0.9,4]
[null,"ICT Risk management ","Does your management body define, oversee and take responsibility for the ICT risk management framwork? ",5,2,"The management body of the financial entity shall define, approve, oversee and be \nresponsible for the implementation of all arrangements related to the ICT risk management \nframework referred to in Article 6(1).","Partly",0.75,1]
[null,"ICT Risk management ","Bear the ultimate responsibility for managing the organizations ICT risk ",5,2,"(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;","Yes",1,3]
[null,"ICT Risk management ","Maintain policies to in sure high standards of availability, authenticity, integrity, and confidentiality of data",5,2,"(b) put in place policies that aim to ensure the maintenance of high standards of \navailability, authenticity, integrity and confidentiality, of data;","No",0.5,1]
[null,"ICT Risk management ","Set clear roles and responsibilities for all ICT related functions ",5,2,"(c) set clear roles and responsibilities for all ICT-related functions and establish \nappropriate governance arrangements to ensure effective and timely communication, \ncooperation and coordination among those functions;","No",0.1,5]
[null,"ICT Risk management ","bear the overall responsibility for setting and approving the digital operational \nresilience strategy as referred to in Article 6(8), including the determination of the \nappropriate risk tolerance level of ICT risk of the financial entity, as referred to in \nArticle 6(8), point (b);",5,2,"(d) bear the overall responsibility for setting and approving the digital operational \nresilience strategy as referred to in Article 6(8), including the determination of the \nappropriate risk tolerance level of ICT risk of the financial entity, as referred to in \nArticle 6(8), point (b);","No"]
[null,"ICT Risk management ","Approve oversee and periodically review the implementation/upkeep of ICT business continuity policy ",5,2,"(e) approve, oversee and periodically review the implementation of the financial entity’s \nICT business continuity policy and ICT response and recovery plans, referred to, \nrespectively, in Article 11(1) and (3), which may be adopted as a dedicated specific \npolicy forming an integral part of the financial entity’s overall business continuity \npolicy and response and recovery plan;","Partly"]
[null,"ICT Risk management ","Approve and periodically review ICT internal audit plans, ICT audits, and modification to them. ",5,2,"(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT \naudits and material modifications to them;"]
[null,"ICT Risk management ","Allocate and periodically review the appropriate budget to fulfil the financial entity digital operational resilience, including: ICT security awareness programs and digital resilience trainings",5,2,"(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s \ndigital operational resilience needs in respect of all types of resources, including \nrelevant ICT security awareness programmes and digital operational resilience \ntraining referred to in Article 13(6), and ICT skills for all staff;"]
[null,"ICT Risk management ","Approve and periodically approve all ICT service providers ",5,2,"(h) approve and periodically review the financial entity’s policy on arrangements \nregarding the use of ICT services provided by ICT third-party service providers;"]
[null,"ICT Risk management ","Put in place at corporate level, reporting channels informing the organization following: ",5,2,"(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:"]
[null,"ICT Risk management ","Arrangement concluded with ICT third-party service providers ",5,2,"(i) arrangements concluded with ICT third-party service providers on the use of ICT services,"]
[null,"ICT Risk management ","The potential impact of such changes on the critical or important functions subject to those arrangements. ",5,2]
[null,"ICT Risk management ","Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party services providers. ",5,3,"3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation."]
[null,"ICT Risk management ","are the organizations members of the management shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risks and its impacts of the operations ",5,4,"4. Members of the management body of the financial entity shall actively keep up to date \nwith sufficient knowledge and skills to understand and assess ICT risk and its impact on \nthe operations of the financial entity, including by following specific training on a regular \nbasis, commensurate to the ICT risk being managed."]
[null,"ICT Risk management ","The financial entities have a sound comprehensive and well-documented ICT risk management framework. ",6,1,"1. Financial entities shall have a sound, comprehensive and well-documented ICT risk \nmanagement framework as part of their overall risk management system, which enables \nthem to address ICT risk quickly, efficiently and comprehensively and to ensure a high \nlevel of digital operational resilience."]
[null,"ICT Risk management ","The organization has ICT risk management Strategies ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT risk management Policies  ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT risk management Procedures ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT Risk management Protocols ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","Does the organization minimize ICT risks by having Strategies, policies, procedures, and ICT protocols and Tools?",6,3,"3. In accordance with their ICT risk management framework, financial entities shall minimise \nthe impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT \nprotocols and tools. They shall provide complete and updated information on ICT risk and \non their ICT risk management framework to the competent authorities upon their request."]
[null,"ICT Risk management ","Are all information relating to ICT risks completed and updated in a database and provided to the competent authorities?",6,4,"4. Financial entities, other than microenterprises, shall assign the responsibility for managing \nand overseeing ICT risk to a control function and ensure an appropriate level of \nindependence of such control function in order to avoid conflicts of interest. Financial \nentities shall ensure appropriate segregation and independence of ICT risk management \nfunctions, control functions, and internal audit functions, according to the three lines of \ndefence model, or an internal risk management and control model."]
[null,"ICT Risk management ","Have the organization assigned the responsibilities for managing and overseeing the ICT risk to a control function who needs to be independent and separated in accordance with the three lines of defense? ",6,4,"4. Financial entities, other than microenterprises, shall assign the responsibility for managing \nand overseeing ICT risk to a control function and ensure an appropriate level of \nindependence of such control function in order to avoid conflicts of interest. Financial \nentities shall ensure appropriate segregation and independence of ICT risk management \nfunctions, control functions, and internal audit functions, according to the three lines of \ndefence model, or an internal risk management and control model."]
[null,"ICT Risk management ","Are a review cycle once a year put into place or whenever a big incident occurs or larger changes to the organization? ",6,5,"5. The ICT risk management framework shall be documented and reviewed at least once a \nyear, or periodically in the case of microenterprises, as well as upon the occurrence of \nmajor ICT-related incidents, and following supervisory instructions or conclusions derived \nfrom relevant digital operational resilience testing or audit processes. It shall be \ncontinuously improved on the basis of lessons derived from implementation and \nmonitoring. A report on the review of the ICT risk management framework shall be \nsubmitted to the competent authority upon its request."]
[null,"ICT Risk management ","Does the internal audit organization have sufficient knowledge, skills, expertise to audit the ICT Risk Management Framework?)",6,6,"6. The ICT risk management framework of financial entities, other than microenterprises, \nshall be subject to internal audit by auditors on a regular basis in line with the financial \nentities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise \nin ICT risk, as well as appropriate independence. The frequency and focus of ICT audits \nshall be commensurate to the ICT risk of the financial entity."]
[null,"ICT Risk management ","Does the internal audit organization have the capability to audit regularly ",6,7,"7. Based on the conclusions from the internal audit review, financial entities shall establish a \nformal follow-up process, including rules for the timely verification and remediation of \ncritical ICT audit findings."]
[null,"ICT Risk management ","Does the internal audit have the capability and organization to create/update follow-ups ",6,7,"7. Based on the conclusions from the internal audit review, financial entities shall establish a \nformal follow-up process, including rules for the timely verification and remediation of \ncritical ICT audit findings."]
[null,"ICT Risk management ","Does the Risk Management Framework include: ",6,8,"8. The ICT risk management framework shall include a digital operational resilience strategy \nsetting out how the framework shall be implemented. To that end, the digital operational \nresilience strategy shall include methods to address ICT risk and attain specific ICT \nobjectives, by:"]
[null,"ICT Risk management ","Business strategy and objectives as it relates to the ICT risk management framework ",6,8,"(a) explaining how the ICT risk management framework supports the financial entity’s \nbusiness strategy and objectives;"]
[null,"ICT Risk management ","Established a risk tolerance level for the ICT risk ",6,8,"(b) establishing the risk tolerance level for ICT risk, in accordance with the risk appetite \nof the financial entity, and analysing the impact tolerance for ICT disruptions;"]
[null,"ICT Risk management ","Clear information security objectives including key performance indicators and key risk metrics ",6,8,"(c) setting out clear information security objectives, including key performance \nindicators and key risk metrics;"]
[null,"ICT Risk management ","explaining the ICT reference architecture and how it relates to the specific business objectives ",6,8,"(d) explaining the ICT reference architecture and any changes needed to reach specific \nbusiness objectives;"]
[null,"ICT Risk management ","outlining mechanisms (methods) to detect ICT-related incidents and to prevent their impact and provide protection from it ",6,8,"(e) outlining the different mechanisms put in place to detect ICT-related incidents, \nprevent their impact and provide protection from it;"]
[null,"ICT Risk management ","Situational Awareness for major ICT related Incidents ",6,8,"(f) evidencing the current digital operational resilience situation on the basis of the \nnumber of major ICT-related incidents reported and the effectiveness of preventive \nmeasures;"]
[null,"ICT Risk management ","Implementation of digital operational resilience testing ",6,8,"(g) implementing digital operational resilience testing, in accordance with Chapter IV of \nthis Regulation;"]
[null,"ICT Risk management ","Outlining of communication strategy in case of an incident ",6,8,"(h) outlining a communication strategy in the event of ICT-related incidents the \ndisclosure of which is required in accordance with Article 14."]
[null,"ICT Risk management ","Does the organization have a holistic ICT multi-vendor strategy at group level ",6,9,"9. Financial entities may, in the context of the digital operational resilience strategy referred \nto in paragraph 8, define a holistic ICT multi-vendor strategy, at group or entity level, \nshowing key dependencies on ICT third-party service providers and explaining the \nrationale behind the procurement mix of ICT third-party service providers."]
[null,"ICT Risk management ","The organization can outsource the task of verifying compliance of the ICT Risk Management both to intra-group and external undertakers",6,10,"10. Financial entities may, in accordance with Union and national sectoral law, outsource the \ntasks of verifying compliance with ICT risk management requirements to intra-group or \nexternal undertakings. In case of such outsourcing, the financial entity remains fully \nresponsible for the verification of compliance with the ICT risk management requirements."]
[null,"ICT Risk management ","In order to address and manage ICT risk, financial entities shall use and maintain updated ICT \nsystems, protocols and tools that are:",7,1,"In order to address and manage ICT risk, financial entities shall use and maintain updated ICT \nsystems, protocols and tools that are:"]
[null,"ICT Risk management ","appropriate to the magnitude of operations supporting the conduct of their activities, in \naccordance with the proportionality principle as referred to in Article 4;",7,1,"(a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;"]
[null,"ICT Risk management ","(b) reliable;",7,1,"(b) reliable;"]
[null,"ICT Risk management ","equipped with sufficient capacity to accurately process the data necessary for the \nperformance of activities and the timely provision of services, and to deal with peak orders, \nmessage or transaction volumes, as needed, including where new technology is introduced",7,1,"(c) equipped with sufficient capacity to accurately process the data necessary for the \nperformance of activities and the timely provision of services, and to deal with peak orders, \nmessage or transaction volumes, as needed, including where new technology is introduced;"]
[null,"ICT Risk management ","technologically resilient in order to adequately deal with additional information processing \nneeds as required under stressed market conditions or other adverse situations.",7,1,"(d) technologically resilient in order to adequately deal with additional information processing \nneeds as required under stressed market conditions or other adverse situations."]
[null,"ICT Risk management ","Does the organization identify, classify and adequently document all ICT supported functions, roles and responsiblities, information and other ICT assets supporting those functions",8,1,"As part of the ICT risk management framework referred to in Article 6(1), financial \nentities shall identify, classify and adequately document all ICT supported business \nfunctions, roles and responsibilities, the information assets and ICT assets supporting those \nfunctions, and their roles and dependencies in relation to ICT risk. Financial entities shall \nreview as needed, and at least yearly, the adequacy of this classification and of any \nrelevant documentation."]
[null,"ICT Risk management ","Does the organization identify all sources of ICT risks; especially the ICT risks coming from other and to other financial entities, cyber threats, and ICT vulnerabilities ",8,2,"2. Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them."]
[null,"ICT Risk management ","Does the organization do risk assessment on major changes in the network. ",8,3,"3. Financial entities, other than microenterprises, shall perform a risk assessment upon each \nmajor change in the network and information system infrastructure, in the processes or \nprocedures affecting their ICT supported business functions, information assets or ICT \nassets."]
[null,"ICT Risk management ","Does the organization work with identifying all information assets and ICT assets, including remote sites, network resources and hardware equipment. ",8,4,"4. Financial entities shall identify all information assets and ICT assets, including those on \nremote sites, network resources and hardware equipment, and shall map those considered \ncritical. They shall map the configuration of the information assets and ICT assets and the \nlinks and interdependencies between the different information assets and ICT assets."]
[null,"ICT Risk management ","Does the organization identify all processes that are dependent of ICT third party service providers and their interdependencies with third party service providers that work with critical or important functions. ",8,5,"5. Financial entities shall identify and document all processes that are dependent on ICT \nthird-party service providers, and shall identify interconnections with ICT third-party \nservice providers that provide services that support critical or important functions."]
[null,"ICT Risk management ","does the organization maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.",8,6,"6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant \ninventories and update them periodically and every time any major change as referred to in \nparagraph 3 occurs."]
[null,"ICT Risk management ","Does the organization conduct a yearly risk assessment on all legacy systems? ",8,7,"7. Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, \nconduct a specific ICT risk assessment on all legacy ICT systems and, in any case before \nand after connecting technologies, applications or systems."]
[null,"ICT Risk management ","Have the organization implemented continuous monitoring and control mechanisms for the security and functioning of ICT systems and tools, as well as minimization measures for the impact of ICT risk?",9,1,"For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures."]
[null,null,"Have the organization designed, procured, and implemented ICT security policies, procedures, protocols and tools to ensure the resilience, continuity, and availability of ICT systems, particularly for critical or important functions, and to maintain high standards of data availability, authenticity, integrity, and confidentiality?",9,2,"Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit."]
[null,null,"Have the organization used ICT solutions and processes that are appropriate and meet the requirements of ensuring secure data transfer means and minimizing the risk of data corruption, loss, unauthorised access, and technical flaws that may hinder business activity, prevent lack of availability, and ensure that data is protected from risks arising from data management? ",9,"3.","In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall: (a) ensure the security of the means of transfer of data; (b) minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity; (c) prevent the lack of availability, the impairment of the authenticity and integrity, the \nbreaches of confidentiality and the loss of data; (d) ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error."]
[null,null,"Does the organization as part of their ICT Risk Management framwork cover: ",9,4,"4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall: (a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;(b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;(c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof (d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;(e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner; (f) have appropriate and comprehensive documented policies for patches and updates."]
[null,null,"A information security policy defining rules to protect the availability, authenticity,  integrity, and confidentiality ",9,4,"(a) develop and document an information security policy defining rules to protect the \navailability, authenticity, integrity and confidentiality of data, information assets \nand ICT assets, including those of their customers, where applicable;"]
[null,null,"Following a risk-based approach, established a sound network and infrastructure management",9,4,"(b) following a risk-based approach, establish a sound network and infrastructure \nmanagement structure using appropriate techniques, methods and protocols that may \ninclude implementing automated mechanisms to isolate affected information assets \nin the event of cyber-attacks;"]
[null,null,"Implement policies that limit the physical or logical access to information assetrs and ICT assets ",9,4,"(c) implement policies that limit the physical or logical access to information assets and \nICT assets to what is required for legitimate and approved functions and activities \nonly, and establish to that end a set of policies, procedures and controls that address \naccess rights and ensure a sound administration thereof;"]
[null,null," implement policies and protocols for strong authentication mechanisms, based on \nrelevant standards and dedicated control systems, and protection measures of \ncryptographic keys whereby data is encrypted based on results of approved data \nclassification and ICT risk assessment processes",9,4,"implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes"]
[null,null,"implement documented policies, procedures and controls for ICT change \nmanagement,",9,4,"(e) implement documented policies, procedures and controls for ICT change \nmanagement, including changes to software, hardware, firmware components, \nsystems or security parameters, that are based on a risk assessment approach and are \nan integral part of the financial entity’s overall change management process, in order \nto ensure that all changes to ICT systems are recorded, tested, assessed, approved, \nimplemented and verified in a controlled manner;"]
[null,null,"have appropriate and comprehensive documented policies for patches and updates.",9,4,"(f) have appropriate and comprehensive documented policies for patches and updates."]
[null,"ICT Risk management ","Does the organization have mechanisms in place to promptly detect anomalous activities such as: ICT performance issues and ICT related incidents ",10,1,"1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, \nin accordance with Article 17, including ICT network performance issues and ICT-related \nincidents, and to identify potential material single points of failure."]
[null,"ICT Risk management ","Does the dedection mechanism have layers of control, defined alerts and criteria to trigger ICT related incident response processes. ",10,2,"2. The detection mechanisms referred to in paragraph 1 shall enable multiple layers of \ncontrol, define alert thresholds and criteria to trigger and initiate ICT-related incident \nresponse processes, including automatic alert mechanisms for relevant staff in charge of \nICT-related incident response."]
[null,null,"Is he mechanism tested regularly ",10,1,"All detection mechanisms referred to in the first subparagraph shall be regularly tested in \naccordance with Article 25."]
[null,"ICT Risk management ","Does the organization ensure that they have sufficient resources and capabilities to monitor user activity, the occurence of ICT anormalties and ICT related incidents especially cyber attacks ",10,3,"Financial entities shall devote sufficient resources and capabilities to monitor user activity, \nthe occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks."]
[null,"ICT Risk management ","Does the organization have in place effective systems that check trade reports for completness, identify omissions and obvious errors? ",10,4,"Data reporting service providers shall, in addition, have in place systems that can \neffectively check trade reports for completeness, identify omissions and obvious errors, \nand request re-transmission of those reports."]
[null,"ICT Risk management ","Does the organization as part of the ICT risk management framework have a comprehensive ICT business continuity policy as an integrated part of the operational business continuity policy of the financial entity ",11,1,"1. As part of the ICT risk management framework referred to in Article 6(1) and based on the \nidentification requirements set out in Article 8, financial entities shall put in place a \ncomprehensive ICT business continuity policy, which may be adopted as a dedicated \nspecific policy, forming an integral part of the overall business continuity policy of the \nfinancial entity."]
[null,"ICT Risk management ","does the ICT business continuity policy refered to in article 10,1 have arrangements, plans, procedures, and mechanisms aimed at:\n((a) ensure the continuity of the financial entity’s critical or important functions;\n(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions;\n(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;\n(d) estimate preliminary impacts, damages and losses;\n(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article ",11,2,"2. Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aiming to:(a) ensure the continuity of the financial entity’s critical or important functions;(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and \nrecovery actions;(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;(d) estimate preliminary impacts, damages and losses;(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19."]
[null,"ICT Risk management ","Does the organization have ICT Disastter Recovery plans in place, which can be audited by an independent auditor",11,3,"3. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews."]
[null,"ICT Risk management ","Are all ICT business continuity plans especially with regards to Critical or Important functions outsourced tested appropriately is this done in your organization?",11,4,"Financial entities shall put in place, maintain and periodically test appropriate ICT business \ncontinuity plans, notably with regard to critical or important functions outsourced or \ncontracted through arrangements with ICT third-party service providers."]
[null,"ICT Risk management ","Does the organization do the following as part of their comprehensive ICT risk management:\n(a) test the ICT Business Continuity Policy and the ICT Disaster Recovery Plan at least yearly and after substantive changes to the ICT systems;\n(b) test the crisis communication plans established in accordance with Article 13",11,6,"As part of their comprehensive ICT risk management, financial entities shall:\n(a) test the ICT business continuity plans and the ICT response and recovery plans in \nrelation to ICT systems supporting all functions at least yearly, as well as in the event \nof any substantive changes to ICT systems supporting critical or important functions;\n(b) test the crisis communication plans established in accordance with Article 14."]
[null,"ICT Risk management ","Does your organization have a comprehensive Crisis Management function which can be activated in accordance with the business continuity policy or disater recovery plans. ",11,7,"Financial entities, other than microenterprises, shall have a crisis management function, \nwhich, in the event of activation of their ICT business continuity plans or ICT response and \nrecovery plans, shall, inter alia, set out clear procedures to manage internal and external \ncrisis communications in accordance with Article 14."]
[null,"ICT Risk management ","does your organization have clear guidelines for tracking all events taking place before, during and after a disruptive event. ",11,8,"Financial entities shall keep readily accessible records of activities before and during \ndisruption events when their ICT business continuity plans and ICT response and recovery \nplans are activated."]
[null,"ICT Risk management ","Does the organization have the capabilities to share all tests and exercise reports with authorities ",11,9,"Central securities depositories shall provide the competent authorities with copies of the \nresults of the ICT business continuity tests, or of similar exercises."]
[null,"ICT Risk management ","does the organization have the capabilities to report of the losses caused by a ICT disruption",11,10," Financial entities, other than microenterprises, shall report to the competent authorities, \nupon their request, an estimation of aggregated annual costs and losses caused by \nmajor ICT-related incidents."]
[null,"ICT Risk management ","Does your organization as part of the business continuity policy conduct a Business Impact Analysis of their exposures to severe business disruption?",11,5,"As part of the overall business continuity policy, financial entities shall conduct a business \nimpact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, \nfinancial entities shall assess the potential impact of severe business disruptions by means \nof quantitative and qualitative criteria, using internal and external data and scenario \nanalysis, as appropriate. The BIA shall consider the criticality of identified and mapped \nbusiness functions, support processes, third-party dependencies and information assets, and \ntheir interdependencies. Financial entities shall ensure that ICT assets and ICT services are \ndesigned and used in full alignment with the BIA, in particular with regard to adequately \nensuring the redundancy of all critical components."]
[null,"ICT Risk management ","Does the ICT Risk Management Framework contain these elements in order to ensure that ICT systems and data can be restored with minimum downtime: \n(a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;\n(b) restoration and recovery procedures and methods",12,1,"For the purpose of ensuring the restoration of ICT systems and data with minimum \ndowntime, limited disruption and loss, as part of their ICT risk management framework, \nfinancial entities shall develop and document:\n(a) backup policies and procedures specifying the scope of the data that is subject to the \nbackup and the minimum frequency of the backup, based on the criticality of \ninformation or the confidentiality level of the data;\n(b) restoration and recovery procedures and methods"]
[null,"ICT Risk management ","Does the organization have backup systems that can be activated in accordance with the backup policy and procedures as well as restoration and recovery procedures and methods. The organization needs to ensure that the activation of the backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. ",12,2,"Financial entities shall set up backup systems that can be activated in accordance with the \nbackup policies and procedures, as well as restoration and recovery procedures and \nmethods. The activation of backup systems shall not jeopardise the security of the network \nand information systems or the availability, authenticity, integrity or confidentiality of \ndata. Testing of the backup procedures and restoration and recovery procedures and \nmethods shall be undertaken periodically."]
[null,"ICT Risk management ","Does the organization have seperate backup systesms that are segregated from the source ICT system. The system should also be protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of the data and system backups as necessary",12,3,"When restoring backup data using own systems, financial entities shall use ICT systems \nthat are physically and logically segregated from the source ICT system. The ICT systems \nshall be securely protected from any unauthorised access or ICT corruption and allow for \nthe timely restoration of services making use of data and system backups as necessary."]
[null,"ICT Risk management ","Does the organization maintain redundant ICT capacities equipped with resources, capabilities and functions that are adequate to ensure business needs? ",12,4,"Financial entities, other than microenterprises, shall maintain redundant ICT capacities \nequipped with resources, capabilities and functions that are adequate to ensure business \nneeds. Microenterprises shall assess the need to maintain such redundant ICT capacities \nbased on their risk profile."]
[null,"ICT Risk management ","If the organization has central securities depositories it should maintain at least one secondary processing site endowed with edequate; resources, capabilities, functions and staffing arrangements to ensure business needs. The secondary site should: \n(a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event whichhas affected the primary site;\n(b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;\n(c) immediately accessible to the financial entity’s staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable",12,5,"Central securities depositories shall maintain at least one secondary processing site endowed with adequate resources, capabilities, functions and staffing arrangements to ensure business needs. The secondary processing site shall be:\n(a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event whichhas affected the primary site;\n(b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;\n(c) immediately accessible to the financial entity’s staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable."]
[null,"ICT Risk management ","The organization shall determine the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function potential overall impact on market efficiency",12,6,"In determining the recovery time and recovery point objectives for each function, financial \nentities shall take into account whether it is a critical or important function and the \npotential overall impact on market efficiency. Such time objectives shall ensure that, in \nextreme scenarios, the agreed service levels are met."]
[null,"ICT Risk management ","Does the organization ensure that Lessons learned sessions are held after ICT related incidents occur and the organization is recovered, all checks, including any multiple checks and reconciliations? ",12,7,"When recovering from an ICT-related incident, financial entities shall perform necessary checks, including any multiple checks and reconciliations, in order to ensure that the highest level of data integrity is maintained. These checks shall also be performed when reconstructing data from external stakeholders, in order to ensure that all data is consistent between systems."]
[null,"ICT Risk management ","Does the organization have the capabilities and staff to gather information on vulnerabilities, cyber threats, and ICT related incidents. The organization should also be able to analyse the impact ",13,1,"Financial entities shall have in place capabilities and staff to gather information on \nvulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience."]
[null,"ICT Risk management ","Does the organization have in place a method to do ICT related incident reviews \"lessons learned\". Both Cause and Improvements should be identified ",13,2,"Financial entities shall put in place post ICT-related incident reviews after a major \nICT-related incident disrupts their core activities, analysing the causes of disruption and \nidentifying required improvements to the ICT operations or within the ICT business \ncontinuity policy referred to in Article 11."]
[null,"ICT Risk management ","Does the organization have the capability to communicate any changes made after a serious ICT incident. ",13,2,"Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph."]
[null,"ICT Risk management ","Does the organization have the capability to create a ICT related incident reviews which shall determine whether the procedures were followed. All of these factors needs to be included:\n(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity;\n(b) the quality and speed of performing a forensic analysis, where deemed appropriate;\n(c) the effectiveness of incident escalation within the financial entity;\n(d) the effectiveness of internal and external communication.",13,2,"The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following: \n(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity; \n(b) the quality and speed of performing a forensic analysis, where deemed appropriate; \n(c) the effectiveness of incident escalation within the financial entity; \n(d) the effectiveness of internal and external communication."]
[null,"ICT Risk management ","Does the organization have mechanisms to take lessons from the digital operational resilience testing. These lessons should be especially focused on Cyber Attack, activation of ICT Business Continuity Plans, and ICT response and recovery plans. ",13,3,"Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1)."]
[null,"ICT Risk management ","Does the organization monitor the effectiveness of the implementation of their digital operational resilience strategy? ",13,4,"Financial entities shall monitor the effectiveness of the implementation of their digital operational resilience strategy set out in Article 6(8). They shall map the evolution of ICT risk over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity."]
[null,"ICT Risk management ","Does the ICT senior staff in the organization report at least once a year to management ",13,5,"Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3 and put forward recommendations."]
[null,"ICT Risk management ","Does the organization have general training programs for ICT security awareness and digital operational resilience training. ",13,6,"Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i)."]
[null,"ICT Risk management ","Does the organization have the capabilities to monitor relevant technological developments, and how it will effect the organization? ",13,7,"Financial entities, other than microenterprises, shall monitor relevant technological developments on a continuous basis, also with a view to understanding the possible impact of the deployment of such new technologies on ICT security requirements and digital operational resilience. They shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks."]
[null,"ICT Risk management ","Does the organization have crisis communication plans enabling them to communicate clearly about potential ICT related Incidents ",14,1,"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate."]
[null,"ICT Risk management ","Does the organization have policies for  internal and external stakeholder communication. There should be special focus on staff that needs to part of the incident respons and staff that genreally need information ",14,2,"As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed."]
[null,"ICT Risk management ","Does at least one person have the responsibility to implement the communication strategy for ICT related incidents ",14,3,"At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose."]
[null,"ICT Risk management "]
[null,"ICT Risk management ","Does your financial entity have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk",5,1,"Financial entities shall have in place an internal governance and control framework that \nensures an effective and prudent management of ICT risk, in accordance with Article 6(4), \nin order to achieve a high level of digital operational resilience.","Partly",0.9,4]
[null,"ICT Risk management ","Does your management body define, oversee and take responsibility for the ICT risk management framwork? ",5,2,"The management body of the financial entity shall define, approve, oversee and be \nresponsible for the implementation of all arrangements related to the ICT risk management \nframework referred to in Article 6(1).","Partly",0.75,1]
[null,"ICT Risk management ","Bear the ultimate responsibility for managing the organizations ICT risk ",5,2,"(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;","Yes",1,3]
[null,"ICT Risk management ","Maintain policies to in sure high standards of availability, authenticity, integrity, and confidentiality of data",5,2,"(b) put in place policies that aim to ensure the maintenance of high standards of \navailability, authenticity, integrity and confidentiality, of data;","No",0.5,1]
[null,"ICT Risk management ","Set clear roles and responsibilities for all ICT related functions ",5,2,"(c) set clear roles and responsibilities for all ICT-related functions and establish \nappropriate governance arrangements to ensure effective and timely communication, \ncooperation and coordination among those functions;","No",0.1,5]
[null,"ICT Risk management ","bear the overall responsibility for setting and approving the digital operational \nresilience strategy as referred to in Article 6(8), including the determination of the \nappropriate risk tolerance level of ICT risk of the financial entity, as referred to in \nArticle 6(8), point (b);",5,2,"(d) bear the overall responsibility for setting and approving the digital operational \nresilience strategy as referred to in Article 6(8), including the determination of the \nappropriate risk tolerance level of ICT risk of the financial entity, as referred to in \nArticle 6(8), point (b);","No"]
[null,"ICT Risk management ","Approve oversee and periodically review the implementation/upkeep of ICT business continuity policy ",5,2,"(e) approve, oversee and periodically review the implementation of the financial entity’s \nICT business continuity policy and ICT response and recovery plans, referred to, \nrespectively, in Article 11(1) and (3), which may be adopted as a dedicated specific \npolicy forming an integral part of the financial entity’s overall business continuity \npolicy and response and recovery plan;","Partly"]
[null,"ICT Risk management ","Approve and periodically review ICT internal audit plans, ICT audits, and modification to them. ",5,2,"(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT \naudits and material modifications to them;"]
[null,"ICT Risk management ","Allocate and periodically review the appropriate budget to fulfil the financial entity digital operational resilience, including: ICT security awareness programs and digital resilience trainings",5,2,"(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s \ndigital operational resilience needs in respect of all types of resources, including \nrelevant ICT security awareness programmes and digital operational resilience \ntraining referred to in Article 13(6), and ICT skills for all staff;"]
[null,"ICT Risk management ","Approve and periodically approve all ICT service providers ",5,2,"(h) approve and periodically review the financial entity’s policy on arrangements \nregarding the use of ICT services provided by ICT third-party service providers;"]
[null,"ICT Risk management ","Put in place at corporate level, reporting channels informing the organization following: ",5,2,"(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:"]
[null,"ICT Risk management ","Arrangement concluded with ICT third-party service providers ",5,2,"(i) arrangements concluded with ICT third-party service providers on the use of ICT services,"]
[null,"ICT Risk management ","The potential impact of such changes on the critical or important functions subject to those arrangements. ",5,2]
[null,"ICT Risk management ","Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party services providers. ",5,3,"3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation."]
[null,"ICT Risk management ","are the organizations members of the management shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risks and its impacts of the operations ",5,4,"4. Members of the management body of the financial entity shall actively keep up to date \nwith sufficient knowledge and skills to understand and assess ICT risk and its impact on \nthe operations of the financial entity, including by following specific training on a regular \nbasis, commensurate to the ICT risk being managed."]
[null,"ICT Risk management ","The financial entities have a sound comprehensive and well-documented ICT risk management framework. ",6,1,"1. Financial entities shall have a sound, comprehensive and well-documented ICT risk \nmanagement framework as part of their overall risk management system, which enables \nthem to address ICT risk quickly, efficiently and comprehensively and to ensure a high \nlevel of digital operational resilience."]
[null,"ICT Risk management ","The organization has ICT risk management Strategies ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT risk management Policies  ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT risk management Procedures ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","The organization has ICT Risk management Protocols ",6,2,"2. The ICT risk management framework shall include at least strategies, policies, procedures, \nICT protocols and tools that are necessary to duly and adequately protect all information \nassets and ICT assets, including computer software, hardware, servers, as well as to protect \nall relevant physical components and infrastructures, such as premises, data centres and \nsensitive designated areas, to ensure that all information assets and ICT assets are \nadequately protected from risks including damage and unauthorised access or usage."]
[null,"ICT Risk management ","Does the organization minimize ICT risks by having Strategies, policies, procedures, and ICT protocols and Tools?",6,3,"3. In accordance with their ICT risk management framework, financial entities shall minimise \nthe impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT \nprotocols and tools. They shall provide complete and updated information on ICT risk and \non their ICT risk management framework to the competent authorities upon their request."]
[null,"ICT Risk management ","Are all information relating to ICT risks completed and updated in a database and provided to the competent authorities?",6,4,"4. Financial entities, other than microenterprises, shall assign the responsibility for managing \nand overseeing ICT risk to a control function and ensure an appropriate level of \nindependence of such control function in order to avoid conflicts of interest. Financial \nentities shall ensure appropriate segregation and independence of ICT risk management \nfunctions, control functions, and internal audit functions, according to the three lines of \ndefence model, or an internal risk management and control model."]
[null,"ICT Risk management ","Have the organization assigned the responsibilities for managing and overseeing the ICT risk to a control function who needs to be independent and separated in accordance with the three lines of defense? ",6,4,"4. Financial entities, other than microenterprises, shall assign the responsibility for managing \nand overseeing ICT risk to a control function and ensure an appropriate level of \nindependence of such control function in order to avoid conflicts of interest. Financial \nentities shall ensure appropriate segregation and independence of ICT risk management \nfunctions, control functions, and internal audit functions, according to the three lines of \ndefence model, or an internal risk management and control model."]
[null,"ICT Risk management ","Are a review cycle once a year put into place or whenever a big incident occurs or larger changes to the organization? ",6,5,"5. The ICT risk management framework shall be documented and reviewed at least once a \nyear, or periodically in the case of microenterprises, as well as upon the occurrence of \nmajor ICT-related incidents, and following supervisory instructions or conclusions derived \nfrom relevant digital operational resilience testing or audit processes. It shall be \ncontinuously improved on the basis of lessons derived from implementation and \nmonitoring. A report on the review of the ICT risk management framework shall be \nsubmitted to the competent authority upon its request."]
[null,"ICT Risk management ","Does the internal audit organization have sufficient knowledge, skills, expertise to audit the ICT Risk Management Framework?)",6,6,"6. The ICT risk management framework of financial entities, other than microenterprises, \nshall be subject to internal audit by auditors on a regular basis in line with the financial \nentities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise \nin ICT risk, as well as appropriate independence. The frequency and focus of ICT audits \nshall be commensurate to the ICT risk of the financial entity."]
[null,"ICT Risk management ","Does the internal audit organization have the capability to audit regularly ",6,7,"7. Based on the conclusions from the internal audit review, financial entities shall establish a \nformal follow-up process, including rules for the timely verification and remediation of \ncritical ICT audit findings."]
[null,"ICT Risk management ","Does the internal audit have the capability and organization to create/update follow-ups ",6,7,"7. Based on the conclusions from the internal audit review, financial entities shall establish a \nformal follow-up process, including rules for the timely verification and remediation of \ncritical ICT audit findings."]
[null,"ICT Risk management ","Does the Risk Management Framework include: ",6,8,"8. The ICT risk management framework shall include a digital operational resilience strategy \nsetting out how the framework shall be implemented. To that end, the digital operational \nresilience strategy shall include methods to address ICT risk and attain specific ICT \nobjectives, by:"]
[null,"ICT Risk management ","Business strategy and objectives as it relates to the ICT risk management framework ",6,8,"(a) explaining how the ICT risk management framework supports the financial entity’s \nbusiness strategy and objectives;"]
[null,"ICT Risk management ","Established a risk tolerance level for the ICT risk ",6,8,"(b) establishing the risk tolerance level for ICT risk, in accordance with the risk appetite \nof the financial entity, and analysing the impact tolerance for ICT disruptions;"]
[null,"ICT Risk management ","Clear information security objectives including key performance indicators and key risk metrics ",6,8,"(c) setting out clear information security objectives, including key performance \nindicators and key risk metrics;"]
[null,"ICT Risk management ","explaining the ICT reference architecture and how it relates to the specific business objectives ",6,8,"(d) explaining the ICT reference architecture and any changes needed to reach specific \nbusiness objectives;"]
[null,"ICT Risk management ","outlining mechanisms (methods) to detect ICT-related incidents and to prevent their impact and provide protection from it ",6,8,"(e) outlining the different mechanisms put in place to detect ICT-related incidents, \nprevent their impact and provide protection from it;"]
[null,"ICT Risk management ","Situational Awareness for major ICT related Incidents ",6,8,"(f) evidencing the current digital operational resilience situation on the basis of the \nnumber of major ICT-related incidents reported and the effectiveness of preventive \nmeasures;"]
[null,"ICT Risk management ","Implementation of digital operational resilience testing ",6,8,"(g) implementing digital operational resilience testing, in accordance with Chapter IV of \nthis Regulation;"]
[null,"ICT Risk management ","Outlining of communication strategy in case of an incident ",6,8,"(h) outlining a communication strategy in the event of ICT-related incidents the \ndisclosure of which is required in accordance with Article 14."]
[null,"ICT Risk management ","Does the organization have a holistic ICT multi-vendor strategy at group level ",6,9,"9. Financial entities may, in the context of the digital operational resilience strategy referred \nto in paragraph 8, define a holistic ICT multi-vendor strategy, at group or entity level, \nshowing key dependencies on ICT third-party service providers and explaining the \nrationale behind the procurement mix of ICT third-party service providers."]
[null,"ICT Risk management ","The organization can outsource the task of verifying compliance of the ICT Risk Management both to intra-group and external undertakers",6,10,"10. Financial entities may, in accordance with Union and national sectoral law, outsource the \ntasks of verifying compliance with ICT risk management requirements to intra-group or \nexternal undertakings. In case of such outsourcing, the financial entity remains fully \nresponsible for the verification of compliance with the ICT risk management requirements."]
[null,"ICT Risk management ","In order to address and manage ICT risk, financial entities shall use and maintain updated ICT \nsystems, protocols and tools that are:",7,1,"In order to address and manage ICT risk, financial entities shall use and maintain updated ICT \nsystems, protocols and tools that are:"]
[null,"ICT Risk management ","appropriate to the magnitude of operations supporting the conduct of their activities, in \naccordance with the proportionality principle as referred to in Article 4;",7,1,"(a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;"]
[null,"ICT Risk management ","(b) reliable;",7,1,"(b) reliable;"]
[null,"ICT Risk management ","equipped with sufficient capacity to accurately process the data necessary for the \nperformance of activities and the timely provision of services, and to deal with peak orders, \nmessage or transaction volumes, as needed, including where new technology is introduced",7,1,"(c) equipped with sufficient capacity to accurately process the data necessary for the \nperformance of activities and the timely provision of services, and to deal with peak orders, \nmessage or transaction volumes, as needed, including where new technology is introduced;"]
[null,"ICT Risk management ","technologically resilient in order to adequately deal with additional information processing \nneeds as required under stressed market conditions or other adverse situations.",7,1,"(d) technologically resilient in order to adequately deal with additional information processing \nneeds as required under stressed market conditions or other adverse situations."]
[null,"ICT Risk management ","Does the organization identify, classify and adequently document all ICT supported functions, roles and responsiblities, information and other ICT assets supporting those functions",8,1,"As part of the ICT risk management framework referred to in Article 6(1), financial \nentities shall identify, classify and adequately document all ICT supported business \nfunctions, roles and responsibilities, the information assets and ICT assets supporting those \nfunctions, and their roles and dependencies in relation to ICT risk. Financial entities shall \nreview as needed, and at least yearly, the adequacy of this classification and of any \nrelevant documentation."]
[null,"ICT Risk management ","Does the organization identify all sources of ICT risks; especially the ICT risks coming from other and to other financial entities, cyber threats, and ICT vulnerabilities ",8,2,"2. Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them."]
[null,"ICT Risk management ","Does the organization do risk assessment on major changes in the network. ",8,3,"3. Financial entities, other than microenterprises, shall perform a risk assessment upon each \nmajor change in the network and information system infrastructure, in the processes or \nprocedures affecting their ICT supported business functions, information assets or ICT \nassets."]
[null,"ICT Risk management ","Does the organization work with identifying all information assets and ICT assets, including remote sites, network resources and hardware equipment. ",8,4,"4. Financial entities shall identify all information assets and ICT assets, including those on \nremote sites, network resources and hardware equipment, and shall map those considered \ncritical. They shall map the configuration of the information assets and ICT assets and the \nlinks and interdependencies between the different information assets and ICT assets."]
[null,"ICT Risk management ","Does the organization identify all processes that are dependent of ICT third party service providers and their interdependencies with third party service providers that work with critical or important functions. ",8,5,"5. Financial entities shall identify and document all processes that are dependent on ICT \nthird-party service providers, and shall identify interconnections with ICT third-party \nservice providers that provide services that support critical or important functions."]
[null,"ICT Risk management ","does the organization maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.",8,6,"6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant \ninventories and update them periodically and every time any major change as referred to in \nparagraph 3 occurs."]
[null,"ICT Risk management ","Does the organization conduct a yearly risk assessment on all legacy systems? ",8,7,"7. Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, \nconduct a specific ICT risk assessment on all legacy ICT systems and, in any case before \nand after connecting technologies, applications or systems."]
[null,"ICT Risk management ","Have the organization implemented continuous monitoring and control mechanisms for the security and functioning of ICT systems and tools, as well as minimization measures for the impact of ICT risk?",9,1,"For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures."]
[null,null,"Have the organization designed, procured, and implemented ICT security policies, procedures, protocols and tools to ensure the resilience, continuity, and availability of ICT systems, particularly for critical or important functions, and to maintain high standards of data availability, authenticity, integrity, and confidentiality?",9,2,"Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit."]
[null,null,"Have the organization used ICT solutions and processes that are appropriate and meet the requirements of ensuring secure data transfer means and minimizing the risk of data corruption, loss, unauthorised access, and technical flaws that may hinder business activity, prevent lack of availability, and ensure that data is protected from risks arising from data management? ",9,"3.","In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall: (a) ensure the security of the means of transfer of data; (b) minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity; (c) prevent the lack of availability, the impairment of the authenticity and integrity, the \nbreaches of confidentiality and the loss of data; (d) ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error."]
[null,null,"Does the organization as part of their ICT Risk Management framwork cover: ",9,4,"4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall: (a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;(b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;(c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof (d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;(e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner; (f) have appropriate and comprehensive documented policies for patches and updates."]
[null,null,"A information security policy defining rules to protect the availability, authenticity,  integrity, and confidentiality ",9,4,"(a) develop and document an information security policy defining rules to protect the \navailability, authenticity, integrity and confidentiality of data, information assets \nand ICT assets, including those of their customers, where applicable;"]
[null,null,"Following a risk-based approach, established a sound network and infrastructure management",9,4,"(b) following a risk-based approach, establish a sound network and infrastructure \nmanagement structure using appropriate techniques, methods and protocols that may \ninclude implementing automated mechanisms to isolate affected information assets \nin the event of cyber-attacks;"]
[null,null,"Implement policies that limit the physical or logical access to information assetrs and ICT assets ",9,4,"(c) implement policies that limit the physical or logical access to information assets and \nICT assets to what is required for legitimate and approved functions and activities \nonly, and establish to that end a set of policies, procedures and controls that address \naccess rights and ensure a sound administration thereof;"]
[null,null," implement policies and protocols for strong authentication mechanisms, based on \nrelevant standards and dedicated control systems, and protection measures of \ncryptographic keys whereby data is encrypted based on results of approved data \nclassification and ICT risk assessment processes",9,4,"implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes"]
[null,null,"implement documented policies, procedures and controls for ICT change \nmanagement,",9,4,"(e) implement documented policies, procedures and controls for ICT change \nmanagement, including changes to software, hardware, firmware components, \nsystems or security parameters, that are based on a risk assessment approach and are \nan integral part of the financial entity’s overall change management process, in order \nto ensure that all changes to ICT systems are recorded, tested, assessed, approved, \nimplemented and verified in a controlled manner;"]
[null,null,"have appropriate and comprehensive documented policies for patches and updates.",9,4,"(f) have appropriate and comprehensive documented policies for patches and updates."]
[null,"ICT Risk management ","Does the organization have mechanisms in place to promptly detect anomalous activities such as: ICT performance issues and ICT related incidents ",10,1,"1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, \nin accordance with Article 17, including ICT network performance issues and ICT-related \nincidents, and to identify potential material single points of failure."]
[null,"ICT Risk management ","Does the dedection mechanism have layers of control, defined alerts and criteria to trigger ICT related incident response processes. ",10,2,"2. The detection mechanisms referred to in paragraph 1 shall enable multiple layers of \ncontrol, define alert thresholds and criteria to trigger and initiate ICT-related incident \nresponse processes, including automatic alert mechanisms for relevant staff in charge of \nICT-related incident response."]
[null,null,"Is he mechanism tested regularly ",10,1,"All detection mechanisms referred to in the first subparagraph shall be regularly tested in \naccordance with Article 25."]
[null,"ICT Risk management ","Does the organization ensure that they have sufficient resources and capabilities to monitor user activity, the occurence of ICT anormalties and ICT related incidents especially cyber attacks ",10,3,"Financial entities shall devote sufficient resources and capabilities to monitor user activity, \nthe occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks."]
[null,"ICT Risk management ","Does the organization have in place effective systems that check trade reports for completness, identify omissions and obvious errors? ",10,4,"Data reporting service providers shall, in addition, have in place systems that can \neffectively check trade reports for completeness, identify omissions and obvious errors, \nand request re-transmission of those reports."]
[null,"ICT Risk management ","Does the organization as part of the ICT risk management framework have a comprehensive ICT business continuity policy as an integrated part of the operational business continuity policy of the financial entity ",11,1,"1. As part of the ICT risk management framework referred to in Article 6(1) and based on the \nidentification requirements set out in Article 8, financial entities shall put in place a \ncomprehensive ICT business continuity policy, which may be adopted as a dedicated \nspecific policy, forming an integral part of the overall business continuity policy of the \nfinancial entity."]
[null,"ICT Risk management ","does the ICT business continuity policy refered to in article 10,1 have arrangements, plans, procedures, and mechanisms aimed at:\n((a) ensure the continuity of the financial entity’s critical or important functions;\n(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions;\n(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;\n(d) estimate preliminary impacts, damages and losses;\n(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article ",11,2,"2. Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aiming to:(a) ensure the continuity of the financial entity’s critical or important functions;(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and \nrecovery actions;(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;(d) estimate preliminary impacts, damages and losses;(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19."]
[null,"ICT Risk management ","Does the organization have ICT Disastter Recovery plans in place, which can be audited by an independent auditor",11,3,"3. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews."]
[null,"ICT Risk management ","Are all ICT business continuity plans especially with regards to Critical or Important functions outsourced tested appropriately is this done in your organization?",11,4,"Financial entities shall put in place, maintain and periodically test appropriate ICT business \ncontinuity plans, notably with regard to critical or important functions outsourced or \ncontracted through arrangements with ICT third-party service providers."]
[null,"ICT Risk management ","Does the organization do the following as part of their comprehensive ICT risk management:\n(a) test the ICT Business Continuity Policy and the ICT Disaster Recovery Plan at least yearly and after substantive changes to the ICT systems;\n(b) test the crisis communication plans established in accordance with Article 13",11,6,"As part of their comprehensive ICT risk management, financial entities shall:\n(a) test the ICT business continuity plans and the ICT response and recovery plans in \nrelation to ICT systems supporting all functions at least yearly, as well as in the event \nof any substantive changes to ICT systems supporting critical or important functions;\n(b) test the crisis communication plans established in accordance with Article 14."]
[null,"ICT Risk management ","Does your organization have a comprehensive Crisis Management function which can be activated in accordance with the business continuity policy or disater recovery plans. ",11,7,"Financial entities, other than microenterprises, shall have a crisis management function, \nwhich, in the event of activation of their ICT business continuity plans or ICT response and \nrecovery plans, shall, inter alia, set out clear procedures to manage internal and external \ncrisis communications in accordance with Article 14."]
[null,"ICT Risk management ","does your organization have clear guidelines for tracking all events taking place before, during and after a disruptive event. ",11,8,"Financial entities shall keep readily accessible records of activities before and during \ndisruption events when their ICT business continuity plans and ICT response and recovery \nplans are activated."]
[null,"ICT Risk management ","Does the organization have the capabilities to share all tests and exercise reports with authorities ",11,9,"Central securities depositories shall provide the competent authorities with copies of the \nresults of the ICT business continuity tests, or of similar exercises."]
[null,"ICT Risk management ","does the organization have the capabilities to report of the losses caused by a ICT disruption",11,10," Financial entities, other than microenterprises, shall report to the competent authorities, \nupon their request, an estimation of aggregated annual costs and losses caused by \nmajor ICT-related incidents."]
[null,"ICT Risk management ","Does your organization as part of the business continuity policy conduct a Business Impact Analysis of their exposures to severe business disruption?",11,5,"As part of the overall business continuity policy, financial entities shall conduct a business \nimpact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, \nfinancial entities shall assess the potential impact of severe business disruptions by means \nof quantitative and qualitative criteria, using internal and external data and scenario \nanalysis, as appropriate. The BIA shall consider the criticality of identified and mapped \nbusiness functions, support processes, third-party dependencies and information assets, and \ntheir interdependencies. Financial entities shall ensure that ICT assets and ICT services are \ndesigned and used in full alignment with the BIA, in particular with regard to adequately \nensuring the redundancy of all critical components."]
[null,"ICT Risk management ","Does the ICT Risk Management Framework contain these elements in order to ensure that ICT systems and data can be restored with minimum downtime: \n(a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;\n(b) restoration and recovery procedures and methods",12,1,"For the purpose of ensuring the restoration of ICT systems and data with minimum \ndowntime, limited disruption and loss, as part of their ICT risk management framework, \nfinancial entities shall develop and document:\n(a) backup policies and procedures specifying the scope of the data that is subject to the \nbackup and the minimum frequency of the backup, based on the criticality of \ninformation or the confidentiality level of the data;\n(b) restoration and recovery procedures and methods"]
[null,"ICT Risk management ","Does the organization have backup systems that can be activated in accordance with the backup policy and procedures as well as restoration and recovery procedures and methods. The organization needs to ensure that the activation of the backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. ",12,2,"Financial entities shall set up backup systems that can be activated in accordance with the \nbackup policies and procedures, as well as restoration and recovery procedures and \nmethods. The activation of backup systems shall not jeopardise the security of the network \nand information systems or the availability, authenticity, integrity or confidentiality of \ndata. Testing of the backup procedures and restoration and recovery procedures and \nmethods shall be undertaken periodically."]
[null,"ICT Risk management ","Does the organization have seperate backup systesms that are segregated from the source ICT system. The system should also be protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of the data and system backups as necessary",12,3,"When restoring backup data using own systems, financial entities shall use ICT systems \nthat are physically and logically segregated from the source ICT system. The ICT systems \nshall be securely protected from any unauthorised access or ICT corruption and allow for \nthe timely restoration of services making use of data and system backups as necessary."]
[null,"ICT Risk management ","Does the organization maintain redundant ICT capacities equipped with resources, capabilities and functions that are adequate to ensure business needs? ",12,4,"Financial entities, other than microenterprises, shall maintain redundant ICT capacities \nequipped with resources, capabilities and functions that are adequate to ensure business \nneeds. Microenterprises shall assess the need to maintain such redundant ICT capacities \nbased on their risk profile."]
[null,"ICT Risk management ","If the organization has central securities depositories it should maintain at least one secondary processing site endowed with edequate; resources, capabilities, functions and staffing arrangements to ensure business needs. The secondary site should: \n(a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event whichhas affected the primary site;\n(b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;\n(c) immediately accessible to the financial entity’s staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable",12,5,"Central securities depositories shall maintain at least one secondary processing site endowed with adequate resources, capabilities, functions and staffing arrangements to ensure business needs. The secondary processing site shall be:\n(a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event whichhas affected the primary site;\n(b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;\n(c) immediately accessible to the financial entity’s staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable."]
[null,"ICT Risk management ","The organization shall determine the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function potential overall impact on market efficiency",12,6,"In determining the recovery time and recovery point objectives for each function, financial \nentities shall take into account whether it is a critical or important function and the \npotential overall impact on market efficiency. Such time objectives shall ensure that, in \nextreme scenarios, the agreed service levels are met."]
[null,"ICT Risk management ","Does the organization ensure that Lessons learned sessions are held after ICT related incidents occur and the organization is recovered, all checks, including any multiple checks and reconciliations? ",12,7,"When recovering from an ICT-related incident, financial entities shall perform necessary checks, including any multiple checks and reconciliations, in order to ensure that the highest level of data integrity is maintained. These checks shall also be performed when reconstructing data from external stakeholders, in order to ensure that all data is consistent between systems."]
[null,"ICT Risk management ","Does the organization have the capabilities and staff to gather information on vulnerabilities, cyber threats, and ICT related incidents. The organization should also be able to analyse the impact ",13,1,"Financial entities shall have in place capabilities and staff to gather information on \nvulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience."]
[null,"ICT Risk management ","Does the organization have in place a method to do ICT related incident reviews \"lessons learned\". Both Cause and Improvements should be identified ",13,2,"Financial entities shall put in place post ICT-related incident reviews after a major \nICT-related incident disrupts their core activities, analysing the causes of disruption and \nidentifying required improvements to the ICT operations or within the ICT business \ncontinuity policy referred to in Article 11."]
[null,"ICT Risk management ","Does the organization have the capability to communicate any changes made after a serious ICT incident. ",13,2,"Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph."]
[null,"ICT Risk management ","Does the organization have the capability to create a ICT related incident reviews which shall determine whether the procedures were followed. All of these factors needs to be included:\n(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity;\n(b) the quality and speed of performing a forensic analysis, where deemed appropriate;\n(c) the effectiveness of incident escalation within the financial entity;\n(d) the effectiveness of internal and external communication.",13,2,"The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following: \n(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity; \n(b) the quality and speed of performing a forensic analysis, where deemed appropriate; \n(c) the effectiveness of incident escalation within the financial entity; \n(d) the effectiveness of internal and external communication."]
[null,"ICT Risk management ","Does the organization have mechanisms to take lessons from the digital operational resilience testing. These lessons should be especially focused on Cyber Attack, activation of ICT Business Continuity Plans, and ICT response and recovery plans. ",13,3,"Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1)."]
[null,"ICT Risk management ","Does the organization monitor the effectiveness of the implementation of their digital operational resilience strategy? ",13,4,"Financial entities shall monitor the effectiveness of the implementation of their digital operational resilience strategy set out in Article 6(8). They shall map the evolution of ICT risk over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity."]
[null,"ICT Risk management ","Does the ICT senior staff in the organization report at least once a year to management ",13,5,"Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3 and put forward recommendations."]
[null,"ICT Risk management ","Does the organization have general training programs for ICT security awareness and digital operational resilience training. ",13,6,"Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i)."]
[null,"ICT Risk management ","Does the organization have the capabilities to monitor relevant technological developments, and how it will effect the organization? ",13,7,"Financial entities, other than microenterprises, shall monitor relevant technological developments on a continuous basis, also with a view to understanding the possible impact of the deployment of such new technologies on ICT security requirements and digital operational resilience. They shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks."]
[null,"ICT Risk management ","Does the organization have crisis communication plans enabling them to communicate clearly about potential ICT related Incidents ",14,1,"As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate."]
[null,"ICT Risk management ","Does the organization have policies for  internal and external stakeholder communication. There should be special focus on staff that needs to part of the incident respons and staff that genreally need information ",14,2,"As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed."]
[null,"ICT Risk management ","Does at least one person have the responsibility to implement the communication strategy for ICT related incidents ",14,3,"At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose."]
[null,"ICT Risk management "]
[null,"ICT-related incident management, classification and reporting","Does the orgnization define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents?",17,1,"Financial entities shall define, establish and implement an ICT-related incident \nmanagement process to detect, manage and notify ICT-related incidents.","Partly",null,1]
[null,"ICT-related incident management, classification and reporting","Does the organization record all ICT-related incidents and significant cyber threats?",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to \nensure that root causes are identified, documented and addressed in order to prevent the \noccurrence of such incidents.","No",null,2]
[null,"ICT-related incident management, classification and reporting","Have the organization established appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents?",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to \nensure that root causes are identified, documented and addressed in order to prevent the \noccurrence of such incidents.","Yes",null,3]
[null,"ICT-related incident management, classification and reporting","Does the procedures and processes include identification and documentation? ",17,2,"Financial entities shall record all ICT-related incidents and significant cyber threats. \nFinancial entities shall establish appropriate procedures and processes to ensure a \nconsistent and integrated monitoring, handling and follow-up of ICT-related incidents, to \nensure that root causes are identified, documented and addressed in order to prevent the \noccurrence of such incidents."]
[null,"ICT-related incident management, classification and reporting","Have the ICT-related incident management process within your organization put in place early warning indicators?",17,3,"The ICT-related incident management process referred to in paragraph 1 shall:\n(a) put in place early warning indicators;"]
[null,"ICT-related incident management, classification and reporting","Have the ICT-related incident management process within your organization established procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity?",17,3,"establish procedures to identify, track, log, categorise and classify ICT-related \nincidents according to their priority and severity and according to the criticality of \nthe services impacted, in accordance with the criteria set out in Article 18(1);"]
[null,"ICT-related incident management, classification and reporting","Have your organization, according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1) assigned roles and responsibilities that need to be activated for different ICT-related incident types and scenarios?",17,3,"(c) assign roles and responsibilities that need to be activated for different ICT-related \nincident types and scenarios;"]
[null,"ICT-related incident management, classification and reporting","Have your organization set out plans for communication to staff, external stakeholders and media in accordance with Article 14?",17,3,"(d) set out plans for communication to staff, external stakeholders and media in \naccordance with Article 14 and for notification to clients, for internal escalation \nprocedures, including ICT-related customer complaints, as well as for the provision \nof information to financial entities that act as counterparts, as appropriate;"]
[null,"ICT-related incident management, classification and reporting","Have your organization set out plans for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate?",17,3,"set out plans for communication to staff, external stakeholders and media in \naccordance with Article 14 and for notification to clients, for internal escalation \nprocedures, including ICT-related customer complaints, as well as for the provision \nof information to financial entities that act as counterparts, as appropriate;"]
[null,"ICT-related incident management, classification and reporting","Have your organization set out plans to ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents?",17,3,"(e) ensure that at least major ICT-related incidents are reported to relevant senior \nmanagement and inform the management body of at least major ICT-related \nincidents, explaining the impact, response and additional controls to be established as \na result of such ICT-related incidents;"]
[null,"ICT-related incident management, classification and reporting","Does your organization explaining the impact, response and additional controls established as a result of such ICT-related incidents?",17,3,"(e) ensure that at least major ICT-related incidents are reported to relevant senior \nmanagement and inform the management body of at least major ICT-related \nincidents, explaining the impact, response and additional controls to be established as \na result of such ICT-related incidents;"]
[null,"ICT-related incident management, classification and reporting","Have your organization established ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner?",17,3,"establish ICT-related incident response procedures to mitigate impacts and ensure \nthat services become operational and secure in a timely manner."]
[null,"ICT-related incident management, classification and reporting","Does your organization classify ICT-related incidents and determine their impact based on the following criteria?:\n\n(a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact?;\n\n(b) the duration of the ICT-related incident, including the service downtime?;\n\n(c) the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States?;\n\n(d) the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data?;\n\n(e) the criticality of the services affected, including the financial entity’s transactions and operations?;\n\n(f) the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms?",18,1,"Financial entities shall classify ICT-related incidents and shall determine their impact \nbased on the following criteria:\n(a) the number and/or relevance of clients or financial counterparts affected and, where \napplicable, the amount or number of transactions affected by the ICT-related \nincident, and whether the ICT-related incident has caused reputational impact;\n(b) the duration of the ICT-related incident, including the service downtime;\n(c) the geographical spread with regard to the areas affected by the ICT-related incident, \nparticularly if it affects more than two Member States;\n(d) the data losses that the ICT-related incident entails, in relation to availability, \nauthenticity, integrity or confidentiality of data;\n(e) the criticality of the services affected, including the financial entity’s transactions \nand operations;\n(f) the economic impact, in particular direct and indirect costs and losses, of the ICT\u0002related incident in both absolute and relative terms."]
[null,"ICT-related incident management, classification and reporting","Does the organization classify cyber threats based on the service at risk, which impact it has on the transactions, operations, number of relevant clients or financial counterparts ",18,2,"Financial entities shall classify cyber threats as significant based on the criticality of the \nservices at risk, including the financial entity’s transactions and operations, number and/or \nrelevance of clients or financial counterparts targeted and the geographical spread of the \nareas at risk"]
[null,"ICT-related incident management, classification and reporting","Does your orgnization report major ICT-related incidents to the relevant competent authority using templates referred to in Article 20?",19,1,"Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article."]
[null,"ICT-related incident management, classification and reporting","Does your organization voluntarily notify significant cyber threats to the relevant competent authority?",19,2,"Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant \ncompetent authority when they deem the threat to be of relevance to the financial system, \nservice users or clients. The relevant competent authority may provide such information to \nother relevant authorities referred to in paragraph 6."]
[null,"ICT-related incident management, classification and reporting","Does your orgnization inform your clients without undue delay in the event of major ICT-related incidents that have an impact on their financial interests or significant cyber threats?",19,3,"Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident."]
[null,"ICT-related incident management, classification and reporting","Does your orgnization submit an initial notification, intermediate report, and final report to the relevant competent authority within specified time limits using the templates referred to in Article 20?",19,4,"Financial entities shall, within the time-limits to be laid down in accordance with \nArticle 20, first subparagraph, point (a), point (2), submit the following to the relevant \ncompetent authority:\n(a) an initial notification;\n(b) an intermediate report after the initial notification referred to in point (a), as soon as \nthe status of the original incident has changed significantly or the handling of the \nmajor ICT-related incident has changed based on new information available, \nfollowed, as appropriate, by updated notifications every time a relevant status update \nis available, as well as upon a specific request of the competent authority;"]
[null,"ICT-related incident management, classification and reporting","Does your orgnization outsource reporting obligations to a third-party service provider but remain fully responsible for meeting the reporting requirements?",19,4,"Financial entities shall, within the time-limits to be laid down in accordance with Article 20, first subparagraph, point (a), point (2), submit the following to the relevant competent authority: (a) an initial notification; (b) an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority;"]
[null,"Digital operational resilience testing","Does your orgnization establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6?",24,1,"For the purpose of assessing preparedness for handling ICT-related incidents, of \nidentifying weaknesses, deficiencies and gaps in digital operational resilience, and of \npromptly implementing corrective measures, financial entities, other than microenterprises, \nshall, taking into account the criteria set out in Article 4(2), establish, maintain and review \na sound and comprehensive digital operational resilience testing programme as an integral \npart of the ICT risk-management framework referred to in Article 6.","Partly",0.9,1]
[null,"Digital operational resilience testing","Does the orgnizations programme include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26?",24,2,"The digital operational resilience testing programme shall include a range of assessments, \ntests, methodologies, practices and tools to be applied in accordance with Articles 25 \nand 26.","Partly",0.8,2]
[null,"Digital operational resilience testing","When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, does your orgnization follow a risk-based approach taking into account the criteria set out in Article 4(2)? \n\na) Does your orgnization duly considering the evolving landscape of ICT risk, any specific risks to which the orgnization is or might be exposed?\n\nb)Does your orgnization duly considering the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate?",24,3,"3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.","Nej ",0.75,3]
[null,"Digital operational resilience testing","Does the organization ensure that tests are undertaken by independent parties, whether internal or external?",24,4,"Financial entities, other than microenterprises, shall ensure that tests are undertaken by \nindependent parties, whether internal or external. Where tests are undertaken by an internal \ntester, financial entities shall dedicate sufficient resources and ensure that conflicts of \ninterest are avoided throughout the design and execution phases of the test."]
[null,"Digital operational resilience testing","Where tests are undertaken by an internal tester, does the organization dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test?",24,4,"Financial entities, other than microenterprises, shall ensure that tests are undertaken by \nindependent parties, whether internal or external. Where tests are undertaken by an internal \ntester, financial entities shall dedicate sufficient resources and ensure that conflicts of \ninterest are avoided throughout the design and execution phases of the test."]
[null,"Digital operational resilience testing","Have your orgnization established procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests? ",24,5,"Financial entities, other than microenterprises, shall establish procedures and policies to \nprioritise, classify and remedy all issues revealed throughout the performance of the tests \nand shall establish internal validation methodologies to ascertain that all identified \nweaknesses, deficiencies or gaps are fully addressed."]
[null,"Digital operational resilience testing","Have your orgnization established internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed?",24,5,"Financial entities, other than microenterprises, shall establish procedures and policies to \nprioritise, classify and remedy all issues revealed throughout the performance of the tests \nand shall establish internal validation methodologies to ascertain that all identified \nweaknesses, deficiencies or gaps are fully addressed."]
[null,"Digital operational resilience testing","Does your orgnization at least yearly, conduct appropriate tests on all ICT systems and applications supporting critical or important functions?",24,6,"Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions"]
[null,"Third Party Risk Management","Does the organization manage ICT third party Risk as an integrated part of the overall ICT risk management framework? ",28,1,"1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk \nwithin their ICT risk management framework as referred to in Article 6(1), and in \naccordance with the following principles:","Partly",null,1]
[null,"Third Party Risk Management","Is the organization acting as responsible for all service providers running business operations?",28,1,"(a) financial entities that have in place contractual arrangements for the use of ICT \nservices to run their business operations shall, at all times, remain fully responsible \nfor compliance with, and the discharge of, all obligations under this Regulation and \napplicable financial services law;","Partly",null,3]
[null,"Third Party Risk Management","Is ICT third party risk implemented in light of the principle of proportionality taking into account the nature, scale, complexity and importance of ICT related dependencies",28,1,"financial entities’ management of ICT third-party risk shall be implemented in light \nof the principle of proportionality, taking into account:\n(i) the nature, scale, complexity and importance of ICT-related dependencies,\n(ii) the risks arising from contractual arrangements on the use of ICT services \nconcluded with ICT third-party service providers, taking into account the \ncriticality or importance of the respective service, process or function, and the \npotential impact on the continuity and availability of financial services and \nactivities, at individual and at group level","No",null,3]
[null,"Third Party Risk Management","Is ICT third party risk implemented in light of the principle of proportionality taking into account the risks arising from contractual arrangements on the use of ICT services done by ICT third party service providers especially with regards to Criticality or importance service, process or function. with regard to the continuity and availbility of financial services and activities ",28,1,"financial entities’ management of ICT third-party risk shall be implemented in light \nof the principle of proportionality, taking into account:\n(i) the nature, scale, complexity and importance of ICT-related dependencies,\n(ii) the risks arising from contractual arrangements on the use of ICT services \nconcluded with ICT third-party service providers, taking into account the \ncriticality or importance of the respective service, process or function, and the \npotential impact on the continuity and availability of financial services and \nactivities, at individual and at group level"]
[null,"Third Party Risk Management","As part of the ICT Risk management organizations should maintain and update a data base related to all contractual arrangements on the use of the ICT services provided by ICT third party ",28,1,"As part of their ICT risk management framework, financial entities shall maintain and \nupdate at entity level, and at sub-consolidated and consolidated levels, a register of \ninformation in relation to all contractual arrangements on the use of ICT services provided \nby ICT third-party service providers."]
[null,"Third Party Risk Management","Has the organization  adapted and yearly reviewed a strategy on ICT third-party risk taking into account a multi-vendor strategy? ",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions."]
[null,"Third Party Risk Management","Does the above mentioned strategy provide a policy for vendors serving  critical or important functions? ",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions."]
[null,"Third Party Risk Management","Does the organizations management conduct an overall risk profile based on the third party risk? ",28,2,"2. As part of their ICT risk management framework, financial entities, other than entities \nreferred to in Article 16(1), first subparagraph, and other than microenterprises, shall \nadopt, and regularly review, a strategy on ICT third-party risk, taking into account the \nmulti-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT \nthird-party risk shall include a policy on the use of ICT services supporting critical or \nimportant functions provided by ICT third-party service providers and shall apply on an \nindividual basis and, where relevant, on a sub-consolidated and consolidated basis. The \nmanagement body shall, on the basis of an assessment of the overall risk profile of the \nfinancial entity and the scale and complexity of the business services, regularly review the \nrisks identified in respect to contractual arrangements on the use of ICT services \nsupporting critical or important functions."]
[null,"Third Party Risk Management","Does the organization keep a register for all information relating to ICT third party service providers this needs to be both sub-consolidated and consolidated? ",28,3,"As part of their ICT risk management framework, financial entities shall maintain and \nupdate at entity level, and at sub-consolidated and consolidated levels, a register of \ninformation in relation to all contractual arrangements on the use of ICT services provided \nby ICT third-party service providers"]
[null,"Third Party Risk Management","Are all contractual arrangements documented and distinguishing those ICT services supporting critical or important ",28,3,"The contractual arrangements referred to in the first subparagraph shall be appropriately \ndocumented, distinguishing between those that cover ICT services supporting critical or \nimportant functions and those that do not."]
[null,"Third Party Risk Management","Does the organization report regularly (yearly) to the competent authorities: which services are provided. ",28,3,"Financial entities shall report at least yearly to the competent authorities on the number of \nnew arrangements on the use of ICT services, the categories of ICT third-party service \nproviders, the type of contractual arrangements and the ICT services and functions which \nare being provided."]
[null,"Third Party Risk Management","Does the organization have the capabilities to share the information with comptetent authorities upon request? ",28,3,"Financial entities shall make available to the competent authority, upon its request, the full \nregister of information or, as requested, specified sections thereof, along with any \ninformation deemed necessary to enable the effective supervision of the financial entity."]
[null,"Third Party Risk Management","Does the organization have the capability to inform authorities in a timely manner about any planned contractual arrangement on the use of ICT services supporting Critical or Important Functions? ",28,3,"Financial entities shall inform the competent authority in a timely manner about any \nplanned contractual arrangement on the use of ICT services supporting critical or important \nfunctions as well as when a function has become critical or important."]
[null,"Third Party Risk Management","Does the organization before entering into a contractual arrangement on the use of ICT services ensure: \n(a) assess whether the contractual arrangement covers the use of ICT services supporting \na critical or important function;\n(b) assess if supervisory conditions for contracting are met;\n(c) identify and assess all relevant risks in relation to the contractual arrangement, \nincluding the possibility that such contractual arrangement may contribute to \nreinforcing ICT concentration risk as referred to in Article 29;\n(d) undertake all due diligence on prospective ICT third-party service providers and \nensure throughout the selection and assessment processes that the ICT third-party \nservice provider is suitable;\n(e) identify and assess conflicts of interest that the contractual arrangement may cause.",28,4,"4. Before entering into a contractual arrangement on the use of ICT services, financial entities \nshall:\n(a) assess whether the contractual arrangement covers the use of ICT services supporting \na critical or important function;\n(b) assess if supervisory conditions for contracting are met;\n(c) identify and assess all relevant risks in relation to the contractual arrangement, \nincluding the possibility that such contractual arrangement may contribute to \nreinforcing ICT concentration risk as referred to in Article 29;\n(d) undertake all due diligence on prospective ICT third-party service providers and \nensure throughout the selection and assessment processes that the ICT third-party \nservice provider is suitable;\n(e) identify and assess conflicts of interest that the contractual arrangement may cause"]
[null,"Third Party Risk Management","Does the organization ensure that all ICT third-parties which they enter into agreement with comply with appropriate information security standards ",28,5,"Financial entities may only enter into contractual arrangements with ICT third-party \nservice providers that comply with appropriate information security standards. When those \ncontractual arrangements concern critical or important functions, financial entities shall, \nprior to concluding the arrangements, take due consideration of the use, by ICT third-party \nservice providers, of the most up-to-date and highest quality information \nsecurity standards."]
[null,"Third Party Risk Management","Does the organization have exercise access, inspection and audit rights over the ICT third-party service provider? Does the organization use a risk based approach to pre-determine the frequence of audits and inspections? ",28,6,"In exercising access, inspection and audit rights over the ICT third-party service provider, \nfinancial entities shall, on the basis of a risk-based approach, pre-determine the frequency \nof audits and inspections as well as the areas to be audited through adhering to commonly \naccepted audit standards in line with any supervisory instruction on the use and \nincorporation of such audit standards."]
[null,"Third Party Risk Management","Does the organization ensure that all inspectors and auditors have the appropriate skills?",28,6,"Where contractual arrangements concluded with ICT third-party service providers on the \nuse of ICT services entail high technical complexity, the financial entity shall verify that \nauditors, whether internal or external, or a pool of auditors, possess appropriate skills and \nknowledge to effectively perform the relevant audits and assessments."]
[null,"Third Party Risk Management","Does the organization ensure that all rights to termination of contracts are possible in case of the following:\n(a) significant breach by the ICT third-party service provider of applicable laws, \nregulations or contractual terms;\n(b) circumstances identified throughout the monitoring of ICT third-party risk that are \ndeemed capable of altering the performance of the functions provided through the \ncontractual arrangement, including material changes that affect the arrangement or \nthe situation of the ICT third-party service provider;\n(c) ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT \nrisk management and in particular in the way it ensures the availability, authenticity, \nintegrity and, confidentiality, of data, whether personal or otherwise sensitive data, or \nnon-personal data;\n(d) where the competent authority can no longer effectively supervise the financial entity \nas a result of the conditions of, or circumstances related to, the respective contractual \narrangement. ",28,7,"7. Financial entities shall ensure that contractual arrangements on the use of ICT services \nmay be terminated in any of the following circumstances:\n(a) significant breach by the ICT third-party service provider of applicable laws, \nregulations or contractual terms;\n(b) circumstances identified throughout the monitoring of ICT third-party risk that are \ndeemed capable of altering the performance of the functions provided through the \ncontractual arrangement, including material changes that affect the arrangement or \nthe situation of the ICT third-party service provider;\n(c) ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT \nrisk management and in particular in the way it ensures the availability, authenticity, \nintegrity and, confidentiality, of data, whether personal or otherwise sensitive data, or \nnon-personal data;\n(d) where the competent authority can no longer effectively supervise the financial entity \nas a result of the conditions of, or circumstances related to, the respective contractual \narrangement."]
[null,"Third Party Risk Management","Does the organizations have exit strategies for all services providers providing services to critical or important functions ",28,8,"or ICT services supporting critical or important functions, financial entities shall put in \nplace exit strategies. The exit strategies shall take into account risks that may emerge at the \nlevel of ICT third-party service providers, in particular a possible failure on their part, a \ndeterioration of the quality of the ICT services provided, any business disruption due to \ninappropriate or failed provision of ICT services or any material risk arising in relation to \nthe appropriate and continuous deployment of the respective ICT service, or the \ntermination of contractual arrangements with ICT third-party service providers under any \nof the circumstances listed in paragraph 7.\nFinancial entities shall ensure that they are able to exit contractual arrangements without:\n(a) disruption to their business activities,\n(b) limiting compliance with regulatory requirements,\n(c) detriment to the continuity and quality of services provided to clients.\nExit plans shall be comprehensive, documented and, in accordance with the criteria set out \nin Article 4(2), shall be sufficiently tested and reviewed periodically\nFinancial entities shall identify alternative solutions and develop transition plans enabling \nthem to remove the contracted ICT services and the relevant data from the ICT third-party \nservice provider and to securely and integrally transfer them to alternative providers or \nreincorporate them in-house.\nFinancial entities shall have appropriate contingency measures in place to maintain \nbusiness continuity in the event of the circumstances referred to in the first subparagraph."]
[null,"Third Party Risk Management","Does the organization have alternative plans for the previously named service providers providing services to critical or important functions? ",28,8,"Financial entities shall identify alternative solutions and develop transition plans enabling \nthem to remove the contracted ICT services and the relevant data from the ICT third-party \nservice provider and to securely and integrally transfer them to alternative providers or \nreincorporate them in-house."]
[null,"Third Party Risk Management","Does the organization have contingency and business continuity plans for those providers? ",28,8,"Financial entities shall have appropriate contingency measures in place to maintain \nbusiness continuity in the event of the circumstances referred to in the first subparagraph."]
[null,"Third Party Risk Management","Does the organization have appropriate measures in place to ensure that service providers to critical or important functions are not too hard to replace or that individual service providers have multiple contractual arrangements making the organization too reliant on them. ",29,1," When performing the identification and assessment of risks referred to in Article 28(4), \npoint (c), financial entities shall also take into account whether the envisaged conclusion of \na contractual arrangement in relation to ICT services supporting critical or important \nfunctions would lead to any of the following:\n(a) contracting an ICT third-party service provider that is not easily substitutable; or\n(b) having in place multiple contractual arrangements in relation to the provision of ICT \nservices supporting critical or important functions with the same ICT third-party \nservice provider or with closely connected ICT third-party service providers.\nFinancial entities shall weigh the benefits and costs of alternative solutions, such as the use \nof different ICT third-party service providers, taking into account if and how envisaged \nsolutions match the business needs and objectives set out in their digital resilience strategy."]
[null,"Third Party Risk Management","Does the organization have measures in place to weigh the risk of subcontractors of  a service provider that service critical or important functions. Especially if the sub contractor is in a third country. ",29,2,"Where the contractual arrangements on the use of ICT services supporting critical or \nimportant functions include the possibility that an ICT third-party service provider further \nsubcontracts ICT services supporting a critical or important function to other ICT third\u0002party service providers, financial entities shall weigh benefits and risks that may arise in \nconnection with such subcontracting, in particular in the case of an ICT subcontractor \nestablished in a third-country."]
[null,"Third Party Risk Management","If the service provider in a third country the organization should; under stand the risk relating to data protection ",29,2,"Where contractual arrangements on the use of ICT services supporting critical or important \nfunctions are concluded with an ICT third-party service provider established in a third \ncountry, financial entities shall, in addition to the considerations referred to in the second \nsubparagraph, also consider the compliance with Union data protection rules and the"]
[null,"Third Party Risk Management","If the service provider in a third country the organization should; ensure that there is a possibility for effective enforcement of the law?",29,2]
[null,"Third Party Risk Management","If the service provider in a third country the organization should; insolvency law provisions that apply in the event of a service provider going bankrupt ",29,2,"Where contractual arrangements concern ICT services supporting critical or important \nfunctions, financial entities shall duly consider the insolvency law provisions that would \napply in the event of the ICT third-party service provider’s bankruptcy as well as any \nconstraint that may arise in respect to the urgent recovery of the financial entity’s data."]
[null,"Third Party Risk Management","If the service provider in a third country the organization should; weigh the risk of any constraints that may arise in repect to the urgent recovery of the organizations data ",29,2,"Where contractual arrangements on the use of ICT services supporting critical or important \nfunctions are concluded with an ICT third-party service provider established in a third \ncountry, financial entities shall, in addition to the considerations referred to in the second \nsubparagraph, also consider the compliance with Union data protection rules and the \neffective enforcement of the law in that third country."]
[null,"Third Party Risk Management","Organizations should consider if long and complex sub-contractor networks may effect the way the organization can monitor the service provider. ",29,2,"Where the contractual arrangements on the use of ICT services supporting critical or \nimportant functions provide for subcontracting, financial entities shall assess whether and \nhow potentially long or complex chains of subcontracting may impact their ability to fully \nmonitor the contracted functions and the ability of the competent authority to effectively \nsupervise the financial entity in that respect."]
[null,"Third Party Risk Management","The organization should ensure that the right and obligations of the financial entity and the ICT third party is allocated in writing and the full contract should be documented in one written document available to both parties ",30,null,"The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format"]
[null,"Third Party Risk Management",null,30,2]
[null,"Third Party Risk Management","A clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting.",30,2]
[null,"Third Party Risk Management","The locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations.",30,2,"The locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations."]
[null,"Third Party Risk Management","Provisions on availability, authenticity, integrity, and confidentiality for data protection, including personal data.",30,2,"Provisions on availability, authenticity, integrity, and confidentiality for data protection, including personal data."]
[null,"Third Party Risk Management","Provisions for ensuring access, recovery, and return of personal and non-personal data in the event of the ICT third-party service provider's insolvency, resolution, or discontinuation of business operations or termination of the contractual arrangement.",30,2,"Provisions for ensuring access, recovery, and return of personal and non-personal data in the event of the ICT third-party service provider's insolvency, resolution, or discontinuation of business operations or termination of the contractual arrangement."]
[null,"Third Party Risk Management","Service level descriptions, including updates and revisions thereof.",30,2,"Service level descriptions, including updates and revisions thereof."]
[null,"Third Party Risk Management","Obligation of the ICT third-party service provider to provide assistance to the financial entity, at no additional cost, or at a cost that is determined ex-ante, in case of an ICT incident related to the ICT service provided to the financial entity.",30,2,"Obligation of the ICT third-party service provider to provide assistance to the financial entity, at no additional cost, or at a cost that is determined ex-ante, in case of an ICT incident related to the ICT service provided to the financial entity."]
[null,"Third Party Risk Management","Obligation of the ICT third-party service provider to fully cooperate with the competent authorities and resolution authorities of the financial entity, including persons appointed by them.",30,2,"Obligation of the ICT third-party service provider to fully cooperate with the competent authorities and resolution authorities of the financial entity, including persons appointed by them."]
[null,"Third Party Risk Management","Termination rights and related minimum notice periods for the termination of the contractual arrangement, in accordance with the expectations of competent authorities and resolution authorities.",30,2,"Termination rights and related minimum notice periods for the termination of the contractual arrangement, in accordance with the expectations of competent authorities and resolution authorities."]
[null,"Third Party Risk Management","i) rights of access, inspection and audit by the financial entity or by an appointed third-party, and the right to take copies of relevant documentation, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;",30,2,"i) rights of access, inspection and audit by the financial entity or by an appointed third-party, and the right to take copies of relevant documentation, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;"]
[null,"Third Party Risk Management","he full service level descriptions, including updates and revisions with precise quantitative and qualitative performance targets, to allow effective monitoring and enable corrective actions to be taken when agreed service levels are not met.",30,"3 (a)","he full service level descriptions, including updates and revisions with precise quantitative and qualitative performance targets, to allow effective monitoring and enable corrective actions to be taken when agreed service levels are not met."]
[null,"Third Party Risk Management","Notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions.",30,"(b)","Notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions."]
[null,"Third Party Risk Management","Requirements for the ICT third-party service provider to implement and test business contingency plans and have in place ICT security measures, tools, and policies that provide an appropriate level of security for the provision of services in line with the financial entity's regulatory framework.",30,"(c)","Requirements for the ICT third-party service provider to implement and test business contingency plans and have in place ICT security measures, tools, and policies that provide an appropriate level of security for the provision of services in line with the financial entity's regulatory framework."]
[null,"Third Party Risk Management","The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27.",30,"(d)","The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27."]
[null,"Third Party Risk Management","The right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, including unrestricted rights of access, inspection, and audit by the financial entity or an appointed third party, and the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by competent authorities, the Lead Overseer, financial entity, or an appointed third party. The right to agree on alternative assurance levels if other clients' rights are affected, and the obligation to provide details on the scope, procedures, and frequency of such inspections and audits.",30,"(e)","The right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, including unrestricted rights of access, inspection, and audit by the financial entity or an appointed third party, and the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by competent authorities, the Lead Overseer, financial entity, or an appointed third party. The right to agree on alternative assurance levels if other clients' rights are affected, and the obligation to provide details on the scope, procedures, and frequency of such inspections and audits."]
[null,"Third Party Risk Management","Exit strategies, including the establishment of a mandatory adequate transition period, during which the ICT third-party service provider will continue providing the respective functions or ICT services, allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.\n(i) during which the ICT third-party service provider will continue providing the \nrespective functions, or ICT services, with a view to reducing the risk of \ndisruption at the financial entity or to ensure its effective resolution and \nrestructuring;\n(ii) allowing the financial entity to migrate to another ICT third-party service \nprovider or change to in-house solutions consistent with the complexity of the \nservice provided.",30,"(f)","Exit strategies, including the establishment of a mandatory adequate transition period, during which the ICT third-party service provider will continue providing the respective functions or ICT services, allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.\n(i) during which the ICT third-party service provider will continue providing the \nrespective functions, or ICT services, with a view to reducing the risk of \ndisruption at the financial entity or to ensure its effective resolution and \nrestructuring;\n(ii) allowing the financial entity to migrate to another ICT third-party service \nprovider or change to in-house solutions consistent with the complexity of the \nservice provided."]
[null,"Third Party Risk Management","The organization should ensure to consider to use standard contractual clauses developed for the specific services ",30,4,"When negotiating contractual arrangements, financial entities and ICT third-party service \nproviders shall consider the use of standard contractual clauses developed by public \nauthorities for specific services."]