Recital 6 Outsourcing of incident reporting obligations

Where financial entitiesas defined in Article 2, points (a) to (t) outsource the major ICT-related incident means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; reporting obligations to a third party, competent authoritiesas defined in Article 46 should be aware of the identity of the third-party reporting on behalf of the financial entity prior to the submission of the first notification or reporting, in order to verify the legitimacy of the reporting third party.