Record Keeping

tesztelniük kell az IKT-üzletmenetfolytonossági terveket és az IKT-reagálási és -helyreállítási terveket a valamennyi funkciót támogató IKT-rendszerekhez kapcsolódóan legalább évente, valamint a kritikus vagy fontos funkciókat támogató IKT-rendszereket érintő bármely jelentős változás bekövetkezése esetén;

tesztelniük kell a 14. cikknek megfelelően kialakított válsághelyzeti kommunikációs terveket.

a folytonosság biztosítása a pénzügyi szervezet kritikus vagy fontos funkcióinak ellátásában;

valamennyi IKT-vonatkozású incidensre gyors, megfelelő és eredményes reagálás és annak megoldása a kár mérséklésével, a tevékenység újraindítását és a helyreállítási intézkedéseket előtérbe helyezve;

célzott tervek haladéktalan aktiválása, amelyek lehetővé teszik az IKT-vonatkozású incidensek egyes típusainak megfelelő, elszigetelésre irányuló intézkedések, folyamatok és technológiák alkalmazását, a további károk megelőzését, valamint a 12. cikkel összhangban kialakított célzott reagálási és helyreállítási intézkedéseket;

előzetes hatások, károk és veszteségek felmérése;

olyan kommunikációs és válságkezelési intézkedések meghatározása, amelyek biztosítják a naprakész információk eljuttatását a releváns belső személyzet valamennyi tagja és valamennyi külső érdekelt fél részére a 14. cikk, valamint az illetékes hatóságok részére a 19. cikk szerint.

a description of:

provisions on:

contains a maximum recovery time for their critical functions that is not longer than 2 hours;

takes into account external links and interdependencies within the financial infrastructures, including trading venues cleared by the central counterparty, securities settlement and payment systems, and credit institutions used by the central counterparty or a linked central counterparty;

requires that arrangements are in place to:

takes into account any links and interdependencies to users, critical utilities and critical service providers, other central securities depositories and other market infrastructures;

requires its ICT business continuity arrangements to ensure that the recovery time objective for their critical or important functions shall not be longer than 2 hours.

trading can be resumed within or close to 2 hours of a disruptive incident;

the maximum amount of data that may be lost from any IT service of the trading venue after a disruptive incident is close to zero.

be performed on the basis of test scenarios that simulate potential disruptions, including an adequate set of severe but plausible scenarios;

contain the testing of ICT services provided by ICT third-party service providers, where applicable;

for financial entities, other than microenterprises, as referred to in Article 11(6), second subparagraph, of Regulation (EU) 2022/2554, contain scenarios of switchover from primary ICT infrastructure to the redundant capacity, backups and redundant facilities;

be designed to challenge the assumptions on which the business continuity plans are based, including governance arrangements and crisis communication plans;

contain procedures to verify the ability of the financial entities’ staff, of ICT third-party service providers, of ICT systems, and ICT services to respond adequately to the scenarios duly taken into account in accordance with Article 26(2).

clearing members;

external providers;

relevant institutions in the financial infrastructure with which central counterparties have identified interdependencies in their business continuity policies.

users of the central securities depositories;

critical utilities and critical service providers;

other central securities depositories;

other market infrastructures;

any other institutions with which central securities depositories have identified interdependencies in their business continuity policy.

specify the conditions prompting their activation or deactivation, and any exceptions for such activation or deactivation;

describe what actions are to be taken to ensure the availability, integrity, continuity, and recovery of at least ICT systems and services supporting critical or important functions of the financial entity;

be designed to meet the recovery objectives of the operations of the financial entities;

be documented and made available to the staff involved in the execution of ICT response and recovery plans and be readily accessible in case of emergency;

provide for both short-term and long-term recovery options, including partial systems recovery;

lay down the objectives of ICT response and recovery plans and the conditions to declare a successful execution of those plans.

cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups, and redundant facilities;

scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails, and duly consider the potential impact of the insolvency, or other failures, of any relevant ICT third-party service provider;

partial or total failure of premises, including office and business premises, and data centres;

substantial failure of ICT assets or of the communication infrastructure;

the non-availability of a critical number of staff or staff members in charge of guaranteeing the continuity of operations;

impact of climate change and environment degradation related events, natural disasters, pandemics, and physical attacks, including intrusions and terrorist attacks;

insider attacks;

political and social instability, including, where relevant, in the ICT third-party service provider’s jurisdiction and the location where the data are stored and processed;

widespread power outages.