Guideline 9: Additional information exchanges between the Lead Overseer and competent authorities in relation to oversight activities

9.1 Within 10 working days following the adoption of the request for information to the critical ICT third-party service provider, the Lead Overseer should make available to the Joint Oversight Network and the competent authorities of the financial entities using ICT services provided by a critical ICT third-party service provider, the relevant scope of the request for information submitted to the critical ICT third-party service provider according to Articles 36(1)⁹ and 37(1) of the DORA.

9.2 The Lead Overseer should inform competent authorities of the financial entities using ICT services provided by a critical ICT third-party service provider of any:

• - major incidents with direct or indirect impact on financial entities within the Union when reported by the critical ICT third-party service provider, including relevant details to determine the significance of the incident on financial entities and assess possible cross-border impacts;¹⁰
• - relevant changes in the strategy of the critical ICT third-party service provider on ICT third-party risk;
• - events that could represent an important risk to the continuity and sustainability of the provision of ICT services;
• - reasoned statement that may be submitted by the critical ICT third-party service provider evidencing the expected impact of the draft oversight plan on customers which are entities falling outside of the scope of DORA and where appropriate, formulating solutions to mitigate risks referred to in Article 33(4) of the DORA.

9.3 If a critical ICT third-party service provider liaises with the competent authorities for the purposes of all matters related to the oversight, the competent authorities should make available those communications to the Lead Overseer and remind the critical ICT third-party service provider that

10 See Article 3(2), letter l of Draft regulatory technical standards on the harmonisation of conditions enabling the conduct of the oversight activities under Article 41(1) points (a), b) and (d) of Regulation (EU) 2022/2554 12 the Lead Overseer is its primary point of contact for the purposes of all matters related to the oversight.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související standardy

2. Identifikované požadavky

3. Související standardy

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/