41. To this end, competent authorities should review the methodology and processes applied by the …

To this end, competent authorities should review the methodology and processes applied by the institution to identify the ICT systems and services that are critical, taking into consideration that some ICT systems and services may be considered critical by the institution from a business continuity and availability perspective, a security (e.g. fraud prevention) and/or a confidentiality perspective (e.g. confidential data). When performing the review, competent authorities should conduct their review taking into consideration that critical ICT systems and services should fulfil at least one of the following conditions:

• a. they support the core business operations and distribution channels (e.g. ATMs, internet and mobile banking) of the institution;
• b. they support essential governance processes and corporate functions, including risk management (e.g. risk management and treasury management systems);
• c. they fall under special legal or regulatory requirements (if any) that impose heightened availability, resilience, confidentiality or security requirements (e.g. data protection legislation or possible ‘Recovery Time Objectives’ (RTO, the maximum time within which a system or process must be restored after an incident) and ‘Recovery Point Objective’ (RPO, the maximum time period during which data can be lost in case of an incident)) for some systemically important services (if and where applicable));
• d. they process or store confidential or sensitive data to which unauthorised access could significantly impact the institution’s reputation, financial results or the soundness and continuity of its business (e.g. databases with sensitive customer data); and/or
• e. they provide base line functionalities that are vital for the adequate functioning of the institution (e.g. telecom and connectivity services, ICT and cyber security services) .

3.2.3 Identification of material ICT risks to critical ICT Systems and Services

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/