49. The policy may be merged with the policy foreseen under Article 28(10) of DORA ( ). However, it …

The policy may be merged with the policy foreseen under Article 28(10) of DORA (⁴⁹ ). However, it should differentiate between the following:

• a. ICT services for which DORA requirements apply and non-ICT services;
• b. non-ICT services supporting critical or important functions provided by TPSPs that are authorised by a competent authority and those that are not;
• c. intragroup third-party arrangements, including third-party arrangements within the same institutional protection scheme (including entities fully owned individually or collectively by institutions within the institutional protection scheme), and third-party arrangements with TPSPs outside the group; and
• d. the use of TPSPs located within a Member State and TPSPs located in third countries.

⁴⁹ Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (OJ L, 2024/1773, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1773/oj).

1. Oversigt

1.1 Referencer

• Artikel 28 10

1.2 Identificerede krav

1.3 Relaterede standarder

2. Identificerede krav

3. Relaterede standarder

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/