As part of the regulatory framework, financial entities must establish an ICT Risk Management framework, with specific requirements tailored for smaller financial entities outlined in Article 16, and detailed guidelines for others in Article 5 to Article 15. The JC 2023 39 Consultation Paper, focusing on draft regulatory technical standards (RTS), provides insights into the expectations mandated under Article 15 and 16(3) of the Regulation. This article delves into ICT Business Continuity Management, specifically addressing the requirements outlined in Article 15 (d)(e)(f) and Article 16(3).
Let’s explore the RTS expectations for compliance with Article 15 (d)(e)(f) concerning the implementation of ICT Business Continuity Management. Financial entities are required to establish a comprehensive structure covering the following aspects:
a. Development of an inclusive ICT Business Continuity Policy encompassing requisite components
b. Regular testing of the ICT Business Continuity Plan
c. Implementation of an ICT Response and Recovery plan
a. Development of an inclusive ICT Business Continuity Policy encompassing requisite components
A detailed description of components which need to be part of the ICT Business Continuity Policy has been provided in Article 25 of the RTS ; eg: scope, timeframe, criteria for activation, governance and others. In addition to these requirements , specific requirements have been listed for central counter party entities, central security depositories and trading venues.
b. Regular testing of the ICT Business Continuity Plan
Article 26 of the RTS , details the conditions of testing the ICT Business Continuity Plan ; eg: include ICT third party provider, include realistic scenario, include successful switchover to critical function etc. For specific type of financial entity viz. central counterparty and central depositories additional conditions are detailed. The financial entity is required to document the test results and review the plan at least yearly incorporating the learnings and business changes.
c. Implementation of an ICT Response and Recovery plan
Article 27 of the RTS , details the components of the response and recovery plan ; eg: activation condition, action to be taken, short and long term options etc. The plan should also consider various types of scenarios eg: cyber attack, premises failure, non availability of staff etc. Additionally alternative options should also be available in case primary recovery option is not feasible.
Let’s explore the RTS expectations for compliance with Article 16 (3) Simplified ICT Risk Management Framework concerning the implementation of ICT Business Continuity Management. Smaller financial entities are required to establish a
a. Components of the ICT Business Continuity Plan
b. Testing of Business Continuity Plan
a. Components of the ICT Business Continuity Plan
i) Conduct a business impact analysis
ii) Identify range of scenarios with dependency of ICT assets supporting the critical function
iii) Create a plan considering point (i) and (ii)
iv) Other details of the plan as listed in Article 41 – eg: approved by management, allocation of resources, condition of activation , restoration and recovery plan etc.
b. Testing of Business Continuity Plan
i) Testing at least yearly
ii) Testing to demonstrate re establish critical functions and identify defects
iii) Document test results
