Article 33 3

(a)

ICT requirements to ensure, in particular, the security, availability, continuity, scalability and quality of services which the critical ICT third-party service provider provides to financial entities, as well as the ability to maintain at all times high standards of availability, authenticity, integrity or confidentiality of data;

(b)

the physical security contributing to ensuring the ICT security, including the security of premises, facilities, data centres;

(c)

the risk management processes, including ICT risk management policies, ICT business continuity policy and ICT response and recovery plans;

(d)

the governance arrangements, including an organisational structure with clear, transparent and consistent lines of responsibility and accountability rules enabling effective ICT risk management;

(e)

the identification, monitoring and prompt reporting of material ICT-related incidents to financial entities, the management and resolution of those incidents, in particular cyber-attacks;

(f)

the mechanisms for data portability, application portability and interoperability, which ensure an effective exercise of termination rights by the financial entities;

(g)

the testing of ICT systems, infrastructure and controls;

(h)

the ICT audits;

(i)

the use of relevant national and international standards applicable to the provision of its ICT services to the financial entities.