Recital 3 Principle of proportionality

Pursuant to Article 28(1), point (b), of Regulation (EU) 2022/2554, the financial entitiesas defined in Article 2, points (a) to (t)’ management of ICT third-party risks means an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements; is to take into account the nature, scale, complexity and importance of ICT-related dependencies, and the risks arising from contractual arrangements on the use of ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; concluded with ICT third-party service providers means an undertaking providing ICT services;. That risk assessment should take into account the criticality or importance of the service, process or function of the financial entity and the potential impact on the continuity and availability of financial services and activities, at entity level and at group means a group as defined in Article 2, point (11), of Directive 2013/34/EU; level.