Article 2 · Commission Implementing Regulation (EU) 2025/2160

Contents

Article 2Risk management policies#

1.The risk management policies referred to in Article 19a(1) of Regulation (EU) No 910/2014 shall clearly identify the trust services they apply to, shall be specific to the trust services concerned and shall be approved by the management body of the non-qualified trust service provider.

2.The risk management policies shall include at least all the following elements:

(a)the overall risk tolerance level in accordance with the criticality and required level of security of the trust services, having regard to the latest technological developments;

(b)the relevant risk criteria, including at least the likelihood, impact and level of the risk, taking into account cyber threat intelligence and vulnerabilities;

(c)an approach for the identification and documentation of the risks to the provision of the trust services, taking into account the complete scope of the information system used by the non-qualified trust service provider, including risks associated with the components of the system as well as with any active or passive parties involved in the implementation of the system or in the provision of the trust services;

(d)a process for the evaluation of the identified risks based on the risk criteria referred to in point (b);

(e)a process for the identification, prioritisation and continuous monitoring of the implementation of appropriate risk treatment measures;

(f)a process for continuous monitoring of the implementation of the risk management policies.

3.Non-qualified trust service providers shall establish appropriate procedures and maintain documents to ensure that the requirements set out in the applicable legislation are implemented.

4.Non-qualified trust service providers shall establish appropriate documented procedures ensuring the monitoring of Union and national legislative and regulatory changes that may impact the provision of trust services.