54. For this assessment, competent authorities should, in particular, take into account whether the …

For this assessment, competent authorities should, in particular, take into account whether the framework:

• a. identifies the critical ICT processes and the relevant supporting ICT systems that should be part of the business resilience and continuity plans with:
• i. a comprehensive analysis of dependencies between the critical business processes and supporting systems;
• ii. determination of recovery objectives for the supporting ICT systems (e.g. typically determined by the business and/or regulations in terms of RTO and RPO);
• iii. appropriate contingency planning to enable the availability, continuity, and recovery of critical ICT systems and services to minimize disruption to an institution’s operations within acceptable limits.
• b. has business resilience, continuity control environment policies and standards and operational controls which include:
• i. Measures to avoid that a single scenario, incident or disaster might impact both ICT production and recovery systems;
• ii. ICT system backup and recovery procedures for critical software and data, that ensure that these backups are stored in a secure and sufficiently remote location, so that an incident or disaster cannot destroy or corrupt these critical data;
• iii. monitoring solutions for the timely detection of ICT availability or continuity incidents;
• iv. a documented incident management and escalation process, that also provides guidance on the different incident management and escalation roles and responsibilities, the members of the crisis committee(s) and the chain of command in case of emergency;
• v. physical measures to both protect the institution’s critical ICT infrastructure (e.g. data centres) from environmental risks (e.g. flooding and other natural disasters) and ensure an appropriate operating environment for ICT systems (e.g. air conditioning);
• vi. processes, roles and responsibilities to ensure that also outsourced ICT systems and services are covered by adequate business resilience and continuity solutions and plans;
• vii. ICT performance and capacity planning and monitoring solutions for critical ICT systems and services with defined availability requirements, to detect important performance and capacity constraints in a timely manner;
• viii. solutions to protect critical internet activities or services (e.g. e-banking services), where necessary and appropriate, against denial of service and other cyber-attacks from the internet, aimed at preventing or disturbing access to these activities and services.
• c. tests ICT availability and continuity solutions, against a range of realistic scenarios including cyber-attacks, fail-over tests and tests of back-ups for critical software and data which:
• i. are planned, formalised and documented, and the test results used to strengthen the effectiveness of the ICT availability and continuity solutions;
• ii. include stakeholders and functions within the organisation, such as business line management including business continuity, incident and crisis response teams, as well as relevant external stakeholders in the ecosystem;
• iii. management body and senior management are appropriately involved in (e.g. as part of crisis management teams) and are informed of test results.
• (b) Controls for managing material ICT security risks

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/