Article 28 General principles

TL;DR

This article outlines regulations set by the EU concerning the Digital Operations Resilience Act. Financial entities must manage third-party ICT risk as an integral component of their ICT risk management framework. Financial entities must adopt and regularly review a strategy on ICT third-party risk and update a register of information related to all contractual arrangements with ICT third-party service providers. Before entering into such agreements, financial entities must assess the relevant risks and undertake due diligence on the prospective service provider. Agreements with ICT third-party service providers must comply with appropriate information security standards. Financial entities must verify that auditors have appropriate skills to effectively perform audits and assessments for high technical complexity services. The financial entity must put in place exit strategies for ICT services that support critical or important functions, as well as contingency measures in case of termination. The ESAs will develop draft implementing and regulatory technical standards to establish and further specify the required policies.

Financial entitiesas defined in Article 2, points (a) to (t) shall manage ICT third-party riskmeans an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements; as an integral component of ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; within their ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework as referred to in Article 6(1), and in accordance with the following principles:
1. financial entitiesas defined in Article 2, points (a) to (t) that have in place contractual arrangements for the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;
2. financial entities’ management of ICT third-party riskmeans an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements; shall be implemented in light of the principle of proportionality, taking into account:
  
  the nature, scale, complexity and importance of ICT-related dependencies,
  
  the risks arising from contractual arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; concluded with ICT third-party service providersmeans an undertaking providing ICT services;, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at groupmeans a group as defined in Article 2, point (11), of Directive 2013/34/EU; level.
proportionality Paragraph allows for application of the proportionality principle according to Article 4.
As part of their ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework, financial entitiesas defined in Article 2, points (a) to (t), other than entities referred to in Article 16(1), first subparagraph, and other than microenterprisesmeans a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million;, shall adopt, and regularly review, a strategy on ICT third-party riskmeans an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements;, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party riskmeans an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements; shall include a policy on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; provided by ICT third-party service providersmeans an undertaking providing ICT services; and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis. The management bodymeans a management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council (³¹), Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law; shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.

management body Paragraph has special considerations for 'management body' as defined by Article 3 point 30.

RTS Paragraph is expanded on in a regulatory technical standard.

exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.
As part of their ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework, financial entitiesas defined in Article 2, points (a) to (t) shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided by ICT third-party service providersmeans an undertaking providing ICT services;.

The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; and those that do not.

Financial entitiesas defined in Article 2, points (a) to (t) shall report at least yearly to the competent authoritiesas defined in Article 46 on the number of new arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;, the categories of ICT third-party service providersmeans an undertaking providing ICT services;, the type of contractual arrangements and the ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; and functions which are being provided.

Financial entitiesas defined in Article 2, points (a) to (t) shall make available to the competent authorityas defined in Article 46, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.

Financial entitiesas defined in Article 2, points (a) to (t) shall inform the competent authorityas defined in Article 46 in a timely manner about any planned contractual arrangement on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; as well as when a function has become critical or important.

ITS Paragraph is expanded on in a implementing technical standard.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.
Before entering into a contractual arrangement on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;, financial entitiesas defined in Article 2, points (a) to (t) shall:
1. assess whether the contractual arrangement covers the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting a critical or important functionmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;;
2. assess if supervisory conditions for contracting are met;
3. identify and assess all relevant risks in relation to the contractual arrangement, including the possibility that such contractual arrangement may contribute to reinforcing ICT concentration riskmeans an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole; as referred to in Article 29;
4. undertake all due diligence on prospective ICT third-party service providersmeans an undertaking providing ICT services; and ensure throughout the selection and assessment processes that the ICT third-party service providermeans an undertaking providing ICT services; is suitable;
5. identify and assess conflicts of interest that the contractual arrangement may cause.
COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.
Financial entitiesas defined in Article 2, points (a) to (t) may only enter into contractual arrangements with ICT third-party service providersmeans an undertaking providing ICT services; that comply with appropriate information security standards. When those contractual arrangements concern critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;, financial entitiesas defined in Article 2, points (a) to (t) shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providersmeans an undertaking providing ICT services;, of the most up-to-date and highest quality information security standards.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.
In exercising access, inspection and audit rights over the ICT third-party service providermeans an undertaking providing ICT services;, financial entitiesas defined in Article 2, points (a) to (t) shall, on the basis of a risk-based approach, pre-determine the frequency of audits and inspections as well as the areas to be audited through adhering to commonly accepted audit standards in line with any supervisory instruction on the use and incorporation of such audit standards.

Where contractual arrangements concluded with ICT third-party service providersmeans an undertaking providing ICT services; on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; entail high technical complexity, the financial entity shall verify that auditors, whether internal or external, or a pool of auditors, possess appropriate skills and knowledge to effectively perform the relevant audits and assessments.
Financial entitiesas defined in Article 2, points (a) to (t) shall ensure that contractual arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; may be terminated in any of the following circumstances:
1. significant breach by the ICT third-party service providermeans an undertaking providing ICT services; of applicable laws, regulations or contractual terms;
2. circumstances identified throughout the monitoring of ICT third-party riskmeans an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements; that are deemed capable of altering the performance of the functions provided through the contractual arrangement, including material changes that affect the arrangement or the situation of the ICT third-party service providermeans an undertaking providing ICT services;;
3. ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management and in particular in the way it ensures the availability, authenticity, integrity and, confidentiality, of data, whether personal or otherwise sensitive data, or non-personal data;
4. where the competent authorityas defined in Article 46 can no longer effectively supervise the financial entity as a result of the conditions of, or circumstances related to, the respective contractual arrangement.
For ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;, financial entitiesas defined in Article 2, points (a) to (t) shall put in place exit strategies. The exit strategies shall take into account risks that may emerge at the level of ICT third-party service providersmeans an undertaking providing ICT services;, in particular a possible failure on their part, a deterioration of the quality of the ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided, any business disruption due to inappropriate or failed provision of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; or any material risk arising in relation to the appropriate and continuous deployment of the respective ICT service, or the termination of contractual arrangements with ICT third-party service providersmeans an undertaking providing ICT services; under any of the circumstances listed in paragraph 7.
Financial entitiesas defined in Article 2, points (a) to (t) shall ensure that they are able to exit contractual arrangements without:
1. disruption to their business activities,
2. limiting compliance with regulatory requirements,
3. detriment to the continuity and quality of services provided to clients.
Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.

Financial entitiesas defined in Article 2, points (a) to (t) shall identify alternative solutions and develop transition plans enabling them to remove the contracted ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; and the relevant data from the ICT third-party service providermeans an undertaking providing ICT services; and to securely and integrally transfer them to alternative providers or reincorporate them in-house.

Financial entitiesas defined in Article 2, points (a) to (t) shall have appropriate contingency measures in place to maintain business continuity in the event of the circumstances referred to in the first subparagraph.

proportionality Paragraph allows for application of the proportionality principle according to Article 4.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.
The ESAsEuropean Supervisory Authority shall, through the Joint Committeemeans the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010;, develop draft implementing technical standards to establish the standard templates for the purposes of the register of information referred to in paragraph 3, including information that is common to all contractual arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;. The ESAsEuropean Supervisory Authority shall submit those draft implementing technical standards to the Commission by 17 January 2024.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
The ESAsEuropean Supervisory Authority shall, through the Joint Committeemeans the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010;, develop draft regulatory technical standards to further specify the detailed content of the policy referred to in paragraph 2 in relation to the contractual arrangements on the use of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; provided by ICT third-party service providersmeans an undertaking providing ICT services;.

When developing those draft regulatory technical standards, the ESAsEuropean Supervisory Authority shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations. The ESAsEuropean Supervisory Authority shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.

Table of contents