Annex | Template for sharing information on subcontracting arrangements

Information Category	Key Information Elements
General Information	Name of the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;. Identification code of the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;. Name of contact person and contact details of the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;. Date of submission of the template.
Overview of Subcontracting Arrangements	Mapping of the subcontracting arrangements, including a short description of the purpose and scope of the subcontracting relationships (including an indication on the level of criticality or importance of the subcontracting arrangements for the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;). Specification and description of the types of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; subcontracted and their significance to the ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided to financial entities, in line with the implementing technical standards adopted pursuant to Article 28(9) of Regulation (EU) 2022/2554. When specifying the types of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;, please refer to the list in Annex IV of the implementing technical standards adopted pursuant to Article 28(9) of Regulation (EU) 2022/2554.
Subcontractors’ Information	Name and legal entity details (including identification code) of each subcontractor. Contact information of the staff members responsible for each of the subcontracting relationships in the critical ICT third-party provider management structure. Overview for each subcontractor of the expertise, experience and qualifications related to the contracted ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;.
Description of Services Provided by Subcontractors	Detailed description of the specific ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided by each subcontractor. Breakdown of the responsibilities and tasks allocated to subcontractors by detailing the different roles in the different stages of the ICT processes. Information on the level of access subcontractors have to personal or otherwise sensitive data or systems regarding the ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided to financial entities. Information on the sites from which the services of subcontractors are provided and on the measures taken to address risks arising from services provided outside the Union.
Subcontracting Governance and Oversight	Description of the contractual and governance framework in place to manage subcontracting relationships, including clauses restricting the usage of sensitive data. Explanation of the processes for selecting, engaging and monitoring subcontractors. Overview of performance metrics, service level objectives and agreements, and key performance indicators used to assess subcontractor’s performance and reliability monitoring.
Risk Management and Compliance	Assessment of the subcontractor’s risk profiles and potential impact on the ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided to financial entities. Explanation of the risk mitigation measures implemented to address subcontracting-related risks. Details of subcontractor’s compliance with relevant regulations, including on data protection and industry standards.
Business Continuity and Contingency Planning	Overview of the subcontractor’s business continuity and response and recovery plans. Description of the arrangements in place to ensure service continuity in case of disruptions or termination by the subcontractor. Frequency of tests of the business continuity plans and response and recovery plans by the subcontractors, dates of the latest tests over the past 3 years, and specification if the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31; has been involved in those tests.
Reporting	Description of the reporting mechanisms and frequency of reporting between the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31; and its subcontractors.
Remediation and Incident Management	Outline of the procedures for addressing subcontractor-related incidents, breaches or non-compliance.
Certifications and Audits	Information on any certifications, independent audits or assessments conducted on subcontractors to validate their security controls, quality standards or regulatory compliance. Date and frequency of the audits of the subcontractors conducted by the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;.