ANNEX II — Content of the scope specification document (Article 9(6))

The scope specification document shall contain a list of all critical or important functions identified by the financial entity.

For each identified critical or important function, the following information shall be included:

(a)

where the critical or important function is not included in the scope of the TLPT, the explanation of the reasons for which it is not included;

(b)

where the critical or important function is included in the scope of the TLPT:

(i)

the explanation of the reasons for its inclusion;

(ii)

the identified ICT system(s) supporting that critical or important function;

(iii)

for each identified ICT system:

whether it is outsourced and if so, the name of the ICT third party service provider;

the jurisdictions in which the ICT system is used;

a high-level description of preliminary flag(s), indicating which security aspect of confidentiality, integrity, authenticity or availability is covered by each flag.