Contents
2.The ICT response and recovery plans referred to in paragraph 1 shall identify relevant scenarios, including scenarios of severe business disruptions and increased likelihood of occurrence of disruption. Those plans shall develop scenarios based on current information on threats and on lessons learned from previous occurrences of business disruptions. Financial entities shall duly take into account all of the following scenarios:
(a)cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups, and redundant facilities;
(b)scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails, and duly consider the potential impact of the insolvency, or other failures, of any relevant ICT third-party service provider;
(c)partial or total failure of premises, including office and business premises, and data centres;
(d)substantial failure of ICT assets or of the communication infrastructure;
(e)the non-availability of a critical number of staff or staff members in charge of guaranteeing the continuity of operations;
(f)impact of climate change and environment degradation related events, natural disasters, pandemics, and physical attacks, including intrusions and terrorist attacks;
(g)insider attacks;
(h)political and social instability, including, where relevant, in the ICT third-party service provider’s jurisdiction and the location where the data are stored and processed;
(i)widespread power outages.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.