art_33__para_3

3. The assessment referred to in paragraph 2 shall cover: ICT requirements to ensure, in particular, the security, availability, continuity, scalability and quality of services which the critical ICT third-party service provider provides to financial entities, as well as the ability to maintain at all times high standards of availability, authenticity, integrity or confidentiality of data; the physical security contributing to ensuring the ICT security, including the security of premises, facilities, data centres; the risk management processes, including ICT risk management policies, ICT business continuity policy and ICT response and recovery plans; the governance arrangements, including an organisational structure with clear, transparent and consistent lines of responsibility and accountability rules enabling effective ICT risk management; the identification, monitoring and prompt reporting of material ICT-related incidents to financial entities, the management and resolution of those incidents, in particular cyber-attacks; the mechanisms for data portability, application portability and interoperability, which ensure an effective exercise of termination rights by the financial entities; the testing of ICT systems, infrastructure and controls; the ICT audits; the use of relevant national and international standards applicable to the provision of its ICT services to the financial entities.

← art_33__para_2__para · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.