In this act Article 41 of 42
Article 41 — Format and content of the report on the review of the simplified ICT risk management framework
Financial servicesLevel 2RTSDORAIn forceOfficial source
41(1)Copy link
1.The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall submit the report on the review of the ICT risk management framework referred to in paragraph 2 of that Article in a searchable electronic format.
41(2)Copy link
2.The report referred to in paragraph 1 shall contain all of the following information:
41(2)(a)(i)
i)a description of the context of the report in terms of the nature, scale, and complexity of the financial entity’s services, activities, and operations, the financial entity’s organisation, identified critical functions, strategy, major ongoing projects or activities, and relationships, and the financial entity’s dependence on in-house and outsourced ICT services and systems, or the implications that a total loss or severe degradation of such systems would have on critical or important functions and market efficiency;
Copy link41(2)(a)(ii)
ii)an executive level summary of the current and near-term ICT risk identified, threat landscape, the assessed effectiveness of its controls, and the security posture of the financial entity;
Copy link41(2)(a)(iv)
iv)a summary of the major changes in the ICT risk management framework since the previous report;
Copy link41(2)(a)(v)
v)a summary and a description of the impact of major changes to the simplified ICT risk management framework since the previous report;
Copy link41(2)(b)
b)where applicable, the date of the approval of the report by the management body of the financial entity;
Copy link41(2)(c)(i)
i)where the review has been initiated following supervisory instructions, evidence of such instructions;
Copy link41(2)(c)(ii)
ii)where the review has been initiated following the occurrence of ICT-related incidents, the list of all those ICT-related incidents with related incident root-cause analysis;
Copy link41(2)(f)
f)a summary of findings, and a self-assessment of the severity of the weaknesses, deficiencies, and gaps identified in ICT risk management framework for the review period, including a detailed analysis thereof;
Copy link41(2)(g)
g)remedying measures identified to address weaknesses, deficiencies, and gaps in the simplified ICT risk management framework, and the expected date for implementing those measures, including the follow-up on weaknesses, deficiencies, and gaps identified in previous reports, where those weaknesses, deficiencies, and gaps have not yet been remedied;
Copy link41(2)(h)
h)overall conclusions on the review of the simplified ICT risk management framework, including any further planned developments.\
Copy linkTITLE IV — FINAL PROVISIONS