Recital 25 Report on the ICT risk management framework review

Article 6(5) of Regulation (EU) 2022/2554 requires financial entities to review their ICT riskmeans any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management framework and to provide their competent authority with a report on that review. To enable competent authorities to easily process the information in those reports, and to guarantee an adequate transmission of that information, financial entities should submit those reports in a searchable electronic format.