+Airteagal 25 2.

Airteagal 25 2.

Déanfaidh eintitis airgeadais measúnú trína bpleananna um leanúnachas gnó TFC dá dtagraítear i mír 1 a thástáil, cé acu an bhfuil siad in ann leanúnachas fheidhmeanna criticiúla nó tábhachtacha an eintitis airgeadais a áirithiú. Maidir leis an tástáil:

(a) 

déanfar í ar bhonn cásanna tástála ina n-ionsamhlaítear suaitheadh féideartha, lena n-áirítear sraith leordhóthanach cásanna diana ach inchreidte;

(b) 

beidh tástáil na seirbhísí TFC arna soláthar ag soláthraithe seirbhíse TFC tríú páirtí, i gcás inarb infheidhme;

(c) 

i gcás eintitis airgeadais, seachas micrifhiontair, dá dtagraítear in Airteagal 11(6), an dara fomhír, de Rialachán (AE) 2022/2554, beidh cásanna ann lascaistrithe ón bpríomhbhonneagar TFC chuig an acmhainneacht iomarcach, cúltacaí agus saoráidí iomarcacha;

(d) 

dearfar iad chun dúshlán a thabhairt do na toimhdí ar a bhfuil na pleananna um leanúnachas gnó bunaithe, lena n-áirítear socruithe rialachais agus pleananna cumarsáide géarchéime;

(e) 

beidh nósanna imeachta iontu chun cumas fhoireann na n-eintiteas airgeadais, soláthraithe seirbhíse TFC tríú páirtí, córas TFC, agus seirbhísí TFC a fhíorú le freagairt go leordhóthanach do chásanna a thugtar san áireamh go cuí i gcomhréir le hAirteagal 26(2).

Chun críocha phointe (a), áiritheoidh eintitis airgeadais i gcónaí sa tástáil na cásanna arna mbreithniú maidir le pleananna um leanúnachas gnó a fhorbairt.

Chun críocha phointe (b), déanfaidh eintitis airgeadais breithniú cuí ar chásanna nasctha le dócmhainneacht nó teipeanna soláthraithe seirbhíse TFC tríú páirtí nó nasctha le rioscaí polaitiúla i ndlínsí na soláthraithe seirbhíse TFC tríú páirtí, i gcás inarb ábhartha.

Chun críocha phointe (c), fíorófar sa tástáil cé acu an féidir feidhmeanna criticiúla nó tábhachtacha ar a laghad a oibriú go hiomchuí ar feadh tréimhse ama leordhóthanach, agus cé acu an féidir gnáthfheidhmiú a aischur.

1. Forbhreathnú

,

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
NOREA Business Continuity Policy

Establish an ICT business continuity policy that enables the continuity of critical or important functions, ensures rapid response to incidents, facilitates the resumption of activities, deployment of containment measures, activation and deactivation of response and recovery procedures, estimation of impact, damage, and losses, and provides clear communication to relevant stakeholders. Regularly review the business continuity policy and make necessary adjustments to enhance effectiveness.

Refer to Articles 24.2-4 of the RTS RM for specific requirements for Central counterparties, Trading venues, and Central security depositories.
NOREA Crisis Management
Formulate and maintain a crisis management team tasked with overseeing and coordinating actions during a crisis or major disruption. Regularly review recovery/response plans. Make necessary adjustments to enhance effectiveness.
NOREA Record Keeping
Keep detailed records of activities conducted before, during, and after disruptions, including actions taken and outcomes. Maintain an estimation of aggregated annual costs and losses resulting from major disruptions. This information shall be reported to the regulator upon their request.
NOREA Business Impact analysis
Perform a comprehensive Business Impact Analysis (BIA) of exposures to severe business disruptions. The BIA should be done by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA shall consider the criticality of identified and mapped business functions, support processes, third-party dependencies and information assets, and their interdependencies. Financial entities shall ensure that ICT assets and ICT services are designed and used in full alignment with the BIA, in particular with regard to adequately ensuring the redundancy of all critical components.
NOREA Response and Recovery

Establish comprehensive response and recovery plans encompassing short-term and long-term recovery options. These plans must thoroughly identify potential scenarios and shall duly take into account scenarios of cyber-attacks, switchovers, degradation of critical function provision, premises failure, breakdowns in ICT assets or communication infrastructure, staff unavailability, natural disasters and the impact of climate change, pandemic situations, physical attacks, insider threats, political or social instability, and power outages. Additionally, these plans must incorporate alternative options in cases where primary recovery measures are impractical in the short term due to factors such as cost, risks, logistics, or unforeseen circumstances. Address potential failures of key ICT third-party service providers into the plans.
NOREA Testing and Assessment

Regularly test ICT business continuity, response, and recovery plans, particularly in collaboration with third-party service providers supporting critical or important functions. Testing should  take into account the financial entity’s BIA and the ICT risk assessment and occur on a yearly basis and whenever there are significant changes to systems supporting critical or important functions. 
Tests must be based on realistic scenarios and encompass scenarios like cyber attacks, insolvency or failure of the third-party, backup restores, and switchover between primary and redundant processing sites. 
The testing shall verify whether at least critical or important functions can be operated appropriately, for a sufficient period of time and whether the normal functioning (of the business process) may be restored. Conduct testing of crisis communication plans to ensure effective communication strategies during a crisis or major disruption. Document test results and report any identified deficiencies resulting from the tests to the management body.

Refer to Articles 24.2-3 of the RTS RM for the specific requirements for Central counterparties and Central security depositories.