account information service provider — borrowed from another act; this instrument states no meaning of its own (37)

administrator of critical benchmarks — an administrator of ‘critical benchmarks’ as defined in Article 3(1), point (25), of Regulation (EU) 2016/1011 (57)

ancillary insurance intermediary — borrowed from another act; this instrument states no meaning of its own (50)

central counterparty — borrowed from another act; this instrument states no meaning of its own (40)

central securities depository — borrowed from another act; this instrument states no meaning of its own (42)

credit institution — borrowed from another act; this instrument states no meaning of its own (31)

credit rating agency — borrowed from another act; this instrument states no meaning of its own (54)

critical benchmarks — borrowed from another act; this instrument states no meaning of its own (57)

critical ICT third-party service provider — an ICT third-party service provider designated as critical in accordance with Article 31 (23)

critical or important function — a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law (22)

crowdfunding service provider — borrowed from another act; this instrument states no meaning of its own (58)

crypto-asset service provider — a crypto-asset service provider as defined in the relevant provision of the Regulation on markets in crypto-assets (55)

cyber threat — borrowed from another act; this instrument states no meaning of its own (12)

cyber-attack — a malicious ICT-related incident caused by means of an attempt perpetrated by any threat actor to destroy, expose, alter, disable, steal or gain unauthorised access to, or make unauthorised use of, an asset (14)

data reporting service provider — a data reporting service provider within the meaning of Regulation (EU) No 600/2014, as referred to in Article 2(1), points (34) to (36) thereof (46)

digital operational resilience — the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions (1)

electronic money institution — borrowed from another act; this instrument states no meaning of its own (38)

electronic money institution exempted pursuant to Directive 2009/110/EC — an electronic money institution benefitting from a waiver as referred to in Article 9(1) of Directive 2009/110/EC (39)

group — borrowed from another act; this instrument states no meaning of its own (26)

ICT asset — a software or hardware asset in the network and information systems used by the financial entity (7)

ICT concentration risk — an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole (29)

ICT intra-group service provider — an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control (20)

ICT risk — any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment (5)

ICT services — digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services (21)

ICT subcontractor established in a third country — an ICT subcontractor that is a legal person established in a third-country and that has entered into a contractual arrangement either with an ICT third-party service provider, or with an ICT third-party service provider established in a third country (28)

ICT third-party risk — an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements (18)

ICT third-party service provider — an undertaking providing ICT services (19)

ICT third-party service provider established in a third country — an ICT third-party service provider that is a legal person established in a third-country and that has entered into a contractual arrangement with a financial entity for the provision of ICT services (24)

ICT-related incident — a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity (8)

information asset — a collection of information, either tangible or intangible, that is worth protecting (6)

institution exempted pursuant to Directive 2013/36/EU — an entity as referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU (32)

institution for occupational retirement provision — borrowed from another act; this instrument states no meaning of its own (52)

insurance intermediary — borrowed from another act; this instrument states no meaning of its own (49)

insurance undertaking — borrowed from another act; this instrument states no meaning of its own (47)

investment firm — borrowed from another act; this instrument states no meaning of its own (33)

issuer of asset-referenced tokens — an issuer of asset-referenced tokens as defined in the relevant provision of the Regulation on markets in crypto-assets (56)

Joint Committee — the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 (62)

Lead Overseer — the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation (61)

legacy ICT system — an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT third-party service provider, but that is still in use and supports the functions of the financial entity (3)

major ICT-related incident — an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity (10)

major operational or security payment-related incident — an operational or security payment-related incident that has a high adverse impact on the payment-related services provided (11)

management body — a management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council (31), Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law (30)

management company — borrowed from another act; this instrument states no meaning of its own (45)

manager of alternative investment funds — borrowed from another act; this instrument states no meaning of its own (44)

medium-sized enterprise — a financial entity that is not a small enterprise and employs fewer than 250 persons and has an annual turnover that does not exceed EUR 50 million and/or an annual balance sheet that does not exceed EUR 43 million (64)

microenterprise — a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million (60)

network and information system — a network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555 (2)

operational or security payment-related incident — a single event or a series of linked events unplanned by the financial entities referred to in Article 2(1), points (a) to (d), whether ICT-related or not, that has an adverse impact on the availability, authenticity, integrity or confidentiality of payment-related data, or on the payment-related services provided by the financial entity (9)

parent undertaking — a parent undertaking within the meaning of Article 2, point (9), and Article 22 of Directive 2013/34/EU (27)

payment institution — borrowed from another act; this instrument states no meaning of its own (35)

payment institution exempted pursuant to Directive (EU) 2015/2366 — a payment institution exempted pursuant to Article 32(1) of Directive (EU) 2015/2366 (36)

public authority — any government or other public administration entity, including national central banks (65)

reinsurance intermediary — borrowed from another act; this instrument states no meaning of its own (51)

reinsurance undertaking — borrowed from another act; this instrument states no meaning of its own (48)

securitisation repository — borrowed from another act; this instrument states no meaning of its own (59)

security of network and information systems — security of network and information systems as defined in Article 6, point 2, of Directive (EU) 2022/2555 (4)

significant cyber threat — a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident (13)

small and non-interconnected investment firm — an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 of the European Parliament and of the Council (33) (34)

small enterprise — a financial entity that employs 10 or more persons, but fewer than 50 persons, and has an annual turnover and/or annual balance sheet total that exceeds EUR 2 million, but does not exceed EUR 10 million (63)

small institution for occupational retirement provision — an institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total (53)

subsidiary — a subsidiary undertaking within the meaning of Article 2, point (10), and Article 22 of Directive 2013/34/EU (25)

threat intelligence — information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations (15)

threat-led penetration testing (TLPT) — a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems (17)

trade repository — borrowed from another act; this instrument states no meaning of its own (41)

trading venue — borrowed from another act; this instrument states no meaning of its own (43)

vulnerability — a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited (16)