Article 10 (b)

(i)

applicable risks related to the cyber threat referred to in point (a), including potential vulnerabilities of the systems of the financial entity that can be exploited;

(ii)

the capabilities and intent of threat actors to the extent known by the financial entity;

(iii)

the persistence of the threat and any accrued knowledge about incidents that have impacted the financial entity or its third-party provider, clients or financial counterparts;