Chapter II, Section II, Article 8 · Regulation (EU) 2022/2554

Contents

Article 8Identification#

1.As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.

2.Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them.

3.Financial entities, other than microenterprises, shall perform a risk assessment upon each major change in the network and information system infrastructure, in the processes or procedures affecting their ICT supported business functions, information assets or ICT assets.

4.Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets.

5.Financial entities shall identify and document all processes that are dependent on ICT third-party service providers, and shall identify interconnections with ICT third-party service providers that provide services that support critical or important functions.

6.For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.

7.Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.

Defined terms · 55

Show every defined term

account information service provider
means an account information service provider as referred to in Article 33(1) of Directive (EU) 2015/2366;
administrator of critical benchmarks
means an administrator of ‘critical benchmarks’ as defined in Article 3(1), point (25), of Regulation (EU) 2016/1011;
ancillary insurance intermediary
means an ancillary insurance intermediary as defined in Article 2(1), point (4), of Directive (EU) 2016/97;
central counterparty
means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;
central securities depository
means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;
credit institution
means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council;
credit rating agency
means a credit rating agency as defined in Article 3(1), point (b), of Regulation (EC) No 1060/2009;
critical ICT third-party service provider
means an ICT third-party service provider designated as critical in accordance with Article 31;
critical or important function
means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;
crowdfunding service provider
means a crowdfunding service provider as defined in Article 2(1), point (e), of Regulation (EU) 2020/1503 of the European Parliament and of the Council;
crypto-asset service provider
means a crypto-asset service provider as defined in the relevant provision of the Regulation on markets in crypto-assets;
cyber threat
means ‘cyber threat’ as defined in Article 2, point (8), of Regulation (EU) 2019/881;
cyber-attack
means a malicious ICT-related incident caused by means of an attempt perpetrated by any threat actor to destroy, expose, alter, disable, steal or gain unauthorised access to, or make unauthorised use of, an asset;
data reporting service provider
means a data reporting service provider within the meaning of Regulation (EU) No 600/2014, as referred to in Article 2(1), points (34) to (36) thereof;
digital operational resilience
means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions;
electronic money institution
means an electronic money institution as defined in Article 2, point (1), of Directive 2009/110/EC of the European Parliament and of the Council;
electronic money institution exempted pursuant to Directive 2009/110/EC
means an electronic money institution benefitting from a waiver as referred to in Article 9(1) of Directive 2009/110/EC;
group
means a group as defined in Article 2, point (11), of Directive 2013/34/EU;
information asset
means a collection of information, either tangible or intangible, that is worth protecting;
institution exempted pursuant to Directive 2013/36/EU
means an entity as referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU;
institution for occupational retirement provision
means an institution for occupational retirement provision as defined in Article 6, point (1), of Directive (EU) 2016/2341;
insurance intermediary
means an insurance intermediary as defined in Article 2(1), point (3), of Directive (EU) 2016/97 of the European Parliament and of the Council;
insurance undertaking
means an insurance undertaking as defined in Article 13, point (1), of Directive 2009/138/EC;
investment firm
means an investment firm as defined in Article 4(1), point (1), of Directive 2014/65/EU;
issuer of asset-referenced tokens
means an issuer of asset-referenced tokens as defined in the relevant provision of the Regulation on markets in crypto-assets;
Joint Committee
means the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010;
Lead Overseer
means the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;
legacy ICT system
means an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT third-party service provider, but that is still in use and supports the functions of the financial entity;
major ICT-related incident
means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity;
major operational or security payment-related incident
means an operational or security payment-related incident that has a high adverse impact on the payment-related services provided;
management body
means a management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council, Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law;
management company
means a management company as defined in Article 2(1), point (b), of Directive 2009/65/EC;
manager of alternative investment funds
means a manager of alternative investment funds as defined in Article 4(1), point (b), of Directive 2011/61/EU;
medium-sized enterprise
means a financial entity that is not a small enterprise and employs fewer than 250 persons and has an annual turnover that does not exceed EUR 50 million and/or an annual balance sheet that does not exceed EUR 43 million;
microenterprise
means a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million;
network and information system
means a network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555;
operational or security payment-related incident
means a single event or a series of linked events unplanned by the financial entities referred to in Article 2(1), points (a) to (d), whether ICT-related or not, that has an adverse impact on the availability, authenticity, integrity or confidentiality of payment-related data, or on the payment-related services provided by the financial entity;
parent undertaking
means a parent undertaking within the meaning of Article 2, point (9), and Article 22 of Directive 2013/34/EU;
payment institution
means a payment institution as defined in Article 4, point (4), of Directive (EU) 2015/2366;
payment institution exempted pursuant to Directive (EU) 2015/2366
means a payment institution exempted pursuant to Article 32(1) of Directive (EU) 2015/2366;
public authority
means any government or other public administration entity, including national central banks.
reinsurance intermediary
means a reinsurance intermediary as defined in Article 2(1), point (5), of Directive (EU) 2016/97;
reinsurance undertaking
means a reinsurance undertaking as defined in Article 13, point (4), of Directive 2009/138/EC;
securitisation repository
means a securitisation repository as defined in Article 2, point (23), of Regulation (EU) 2017/2402 of the European Parliament and of the Council;
security of network and information systems
means security of network and information systems as defined in Article 6, point 2, of Directive (EU) 2022/2555;
significant cyber threat
means a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident;
small and non-interconnected investment firm
means an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 of the European Parliament and of the Council;
small enterprise
means a financial entity that employs 10 or more persons, but fewer than 50 persons, and has an annual turnover and/or annual balance sheet total that exceeds EUR 2 million, but does not exceed EUR 10 million;
small institution for occupational retirement provision
means an institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total;
subsidiary
means a subsidiary undertaking within the meaning of Article 2, point (10), and Article 22 of Directive 2013/34/EU;
threat intelligence
means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations;
threat-led penetration testing (TLPT)
means a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems;
trade repository
means a trade repository as defined in Article 2, point (2), of Regulation (EU) No 648/2012;
trading venue
means a trading venue as defined in Article 4(1), point (24), of Directive 2014/65/EU;
vulnerability
means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited;