(2)

the Annex is amended as follows: in Section A, point (16) is replaced by the following: arrangements and measures necessary to maintain the continuous functioning of the institution’s operational processes, including network and information systems that are set up and managed in accordance with Regulation (EU) 2022/2554;’; Section B is amended as follows: point (14) is replaced by the following: an identification of the owners of the systems identified in point (13), service level agreements related thereto, and any software and systems or licenses, including a mapping to their legal entities, critical operations and core business lines, as well as an identification of critical ICT third-party service providers as defined in Article 3, point (23), of Regulation (EU) 2022/2554;’; the following point is inserted: the results of institutions’ digital operational resilience testing under Regulation (EU) 2022/2554;’; Section C is amended as follows: point (4) is replaced by the following: the extent to which the service agreements, including contractual arrangements on the use of ICT services, that the institution maintains are robust and fully enforceable in the event of resolution of the institution;’; the following point is inserted: the digital operational resilience of the network and information systems supporting critical functions and core business lines of the institution, taking into account major ICT-related incident reports and the results of digital operational resilience testing under Regulation (EU) 2022/2554;’.

← (c) · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-13 · Text as adopted (Official Journal); later amendments are not incorporated in this text.