(a)

develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;

(b)

following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;

(c)

implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;

(d)

implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;

(e)

implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;

(f)

have appropriate and comprehensive documented policies for patches and updates.

(a)

the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact;

(b)

the duration of the ICT-related incident, including the service downtime;

(c)

the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States;

(d)

the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data;

(e)

the criticality of the services affected, including the financial entity’s transactions and operations;

(f)

the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.

(a)

put in place early warning indicators;

(b)

establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);

(c)

assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;

(d)

set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;

(e)

ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;

(f)

establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.