VII. cím – Átláthatóság

Institutions should establish sound business continuity management, encompassing appropriate planning and testing to ensure their ability to operate on an ongoing basis and to limit losses in the event of severe business disruption. This should encompass the institution’s business continuity policy and response and recovery plans. Moreover, with respect to the management of ICT risks, the business continuity management should be consistent with the DORA framework⁵⁵ , in particular the ICT business continuity policy adopted according to Article 11(1) of Regulation (EU) 2022/2554 and should contribute to the institution’s operational resilience by ensuring coordinated preparedness across functions, resources and third-party arrangements.

⁵⁵ In particular, Articles 5(2)(e) and 11 of Regulation (EU) 2022/2554 (DORA) as well as Articles 24 to 26 of Commission Delegated Regulation (EU) 2024/1774.

Institutions may establish a specific independent business continuity function, e.g. as part of the RMF. The ICT crisis management function established pursuant to Article 11(7) of Regulation (EU) 2022/2554 may be a part of this function.

In order to establish sound business continuity management, an institution should perform a business impact analysis to identify and measure (quantitatively and qualitatively) the potential impact of severe business disruptions, using internal and external data and scenario analysis. This analysis should cover all business lines and internal units, including the RMF, and should take into account key interdependencies. The results of the analysis should contribute to defining the institution ’s reco very priorities and objectives.

On the basis of the above-mentioned analysis, an institution should put in place:

• a. business continuity and contingency plans to ensure the institution would be able to react appropriately to disruptions and to maintain its critical or important functions in case of disruption; and
• b. response and recovery plans for critical or important functions to enable the institution to return to ordinary business procedures in an appropriate timeframe. Any residual risk from potential business disruptions should be consistent with the institution ’s risk appetite.

Business continuity, contingency, response and recovery plans should be documented and carefully implemented and subject to internal audit review. The documentation should be available to the staff involved in the execution of the plans and should be stored on systems that are physically separated and readily accessible in case of emergency. Appropriate operational resilience and business continuity awareness, including training, should be provided. Plans should be regularly tested and updated. Testing results should be documented, analysed, reported to the management body and used to review the plans accordingly.