7. The management of information and communication technology (ICT) risk and the use of TPSPs to …

The management of information and communication technology (ICT) risk and the use of TPSPs to provide ICT services as defined in Article 3(21) of Regulation (EU) 2022/2554 (DORA) (²⁴ ) are excluded from the scope of application of these Guidelines, as they fall within the scope of DORA. I n this regard, these Guidelines only cover the use of TPSPs that do not provide ICT services supporting critical or important functions under DORA. Consistency has been ensured with DORA and its relevant mandates; while DORA sets out the framework on the management of third-party risks with regard to ICT services, these Guidelines apply to the management of third-party risks with regard to non-ICT services. However financial entities should have a holistic approach covering the management of third-party risk with regard to both ICT and non-ICT services provided by third party service providers.

²⁴ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, pp. 1-79, ELI: http://data.europa.eu/eli/reg/2022/2554/oj).

1. Übersicht

1.1 Referenzen

• Article 3 (21)

1.2 Identifizierte Anforderungen

1.3 Zugehörige Standards

2. Identifizierte Anforderungen

3. Zugehörige Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/