231. When assessing ICT risk management, competent authorities should pay particular attention to …

When assessing ICT risk management, competent authorities should pay particular attention to ICT third-party risk management, including the institution’s concentration level to ICT third-party service providers. For this purpose, competent authorities should ensure close cooperation with the Lead Overseers of critical ICT third-party providers (CTPPs), in accordance with the ESAs’ Joint Guidelines⁴⁶ , in case the institution under assessment receives ICT services from a CTPP. Competent authorities should also review the effectiveness of the dedicated role established by the institution, or the designated member of senior management, on the monitoring of ICT third-party arrangements.

⁴⁶ ESAs’ Joint Guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities under Regulation (EU) 2022/2554 (JC/2024/36).

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Normes associées

2. Exigences identifiées

3. Normes associées

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/