AI Summary of Article 28 General principles
Financial entities are mandated to incorporate ICT third-party risk management within their broader ICT risk framework, ensuring compliance with applicable regulations. They must adopt a proportional approach based on the scale and significance of their ICT dependencies, while also maintaining comprehensive records of all contractual arrangements with third-party service providers.
Entities are required to assess risks before entering into contracts, including potential ICT concentration risks and adherence to stringent information security standards. Furthermore, exit strategies for critical services must be robustly planned to ensure business continuity and compliance, while contractual arrangements can be terminated under specific breach scenarios.
Article 28 General principles
1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles:
(a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;
(b) financial entities' management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account:
(i) the nature, scale, complexity and importance of ICT-related dependencies,
(ii) the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.