215. Competent authorities should review the institution’s relevant documentation, methodology and …

Competent authorities should review the institution’s relevant documentation, methodology and processes, and form an opinion on whether the institution has appropriately identified the ICT systems and ICT services that support critical or important functions. For this purpose, competent authorities should consider:

• a. ICT systems supporting critical or important functions as well as the critical information assets and ICT assets identified by the institution (as per Article 8 of DORA);
• b. key processes dependent on ICT third-party service providers, including interconnections with ICT third-party service providers that support critical or important functions, identified by the institution (as per Article 8.5 of DORA).

Identification and mapping of material ICT risks to ICT systems and ICT services that support critical or importance functions

216.Following the review of the institution’s dependency on information assets and ICT assets, ICT risk profile, ICT systems and ICT services, competent authorities should form an opinion on the material ICT risks that can have a significant prudential impact on the institution’s ICT systems and services that support critical or important functions and a significant impact on its ability to operate under disruption. For this purpose, competent authorities should consider:

• a. financial loss, including potential customer compensation, legal and remediation costs, contractual damages, costs and lost revenue;
• b. potential for business disruption, considering (but not limited to) the criticality of the services affected, including institution’s transactions and operations (including third-party dependencies), the number of clients and/or financial counterparts and/or branches and employees potentially affected;
• c. potential data losses;
• d. potential reputational impact;
• e. potential regulatory impact, including the potential for public censure, fines or even variation of permissions;
• f. potential strategic impact on the institution;
• g. potential geographical spread.

1. Ħarsa ġenerali

1.1 Referenzi

• Artikolu 8 Identifikazzjoni

1.2 Rekwiżiti identifikati

1.3 Standards relatati

2. Rekwiżiti identifikati

3. Standards relatati

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/