Recital 3 Principle of proportionality

Pursuant to Article 28(1), point (b), of Regulation (EU) 2022/2554, the financial entitiesas defined in Article 2, points (a) to (t)’ management of ICT third-party risks means an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements; is to take into account the nature, scale, complexity and importance of ICT-related dependencies, and the risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; arising from contractual arrangements on the use of ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; concluded with ICT third-party service providers means an undertaking providing ICT services;. That risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; assessment should take into account the criticality or importance of the service, process or function of the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; and the potential impact on the continuity and availability of financial services and activities, at entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; level and at group means a group as defined in Article 2, point (11), of Directive 2013/34/EU; level.