Article 24 Components of the ICT business continuity policy

1. a description of:

   1. the objectives of the ICT business continuity policy, including the interrelation of ICT and overall business continuity, and considering the results of the business impact analysis (BIAbusiness impact analysis) referred to in Article 11(5) of Regulation (EU) 2022/2554;

   2. the scope of the ICT business continuity arrangements, plans, procedures, and mechanisms, including limitations and exclusions;

   3. the timeframe to be covered by the ICT business continuity arrangements, plans, procedures, and mechanisms;

   4. the criteria to activate and deactivate ICT business continuity plans, ICT response and recovery plans, and crisis communications plans;

2. provisions on:

   1. the governance and organisation to implement the ICT business continuity policy, including roles, responsibilities and escalation procedures ensuring that sufficient resources are available;

   2. the alignment between the ICT business continuity plans and the overall business continuity plans, concerning at least all of the following:

      1. potential failure scenarios, including the scenarios referred to in Article 26(2) of this Regulation;

      2. recovery objectives, specifying that the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; shall be able to recover the operations of its critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; after disruptions within a recovery time objective and a recovery point objective;

   3. the development of ICT business continuity plans for severe business disruptions as part of those plans, and the prioritisation of ICT business continuity actions using a risk-based approach;

   4. the development, testing and review of ICT response and recovery plans, in accordance with Articles 25 and 26 of this Regulation;

   5. the review of the effectiveness of the implemented ICT business continuity arrangements, plans, procedures and mechanisms, in accordance with Article 26 of this Regulation;

   6. the alignment of the ICT business continuity policy to:

      1. the communication policy referred to in Article 14(2) of Regulation (EU) 2022/2554;

      2. the communication and crisis communication actions referred to in Article 11(2), point (e), of Regulation (EU) 2022/2554.

1. contains a maximum recovery time for their critical functions that is not longer than 2 hours;

2. takes into account external links and interdependencies within the financial infrastructures, including trading venues means a trading venue as defined in Article 4(1), point (24), of Directive 2014/65/EU; cleared by the central counterparty means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;, securities settlement and payment systems, and credit institutions means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (^32^); Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1). used by the central counterparty means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012; or a linked central counterparty means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;;

3. requires that arrangements are in place to:

   1. ensure the continuity of critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; of the central counterparty means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012; based on disaster scenarios;

   2. maintain a secondary processing site capable of ensuring continuity of critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; of the central counterparty means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012; identical to the primary site;

   3. maintain or have immediate access to a secondary business site, to allow staff to ensure continuity of the service if the primary location of business is not available;

   4. consider the need for additional processing sites, in particular where the diversity of the risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; profiles of the primary and secondary sites does not provide sufficient confidence that the central counterparty means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;’s business continuity objectives will be met in all scenarios.

For the purposes of point (a), central counterparties means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012; shall complete end of day procedures and payments on the required time and day in all circumstances.

For the purposes of point (c)(i), arrangements referred to in that point shall address the availability of adequate human resources, the maximum downtime of critical functions, and fail over and recovery to a secondary site.

For the purposes of point (c)(ii), the secondary processing site referred to in that point shall have a geographical risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; profile which is distinct from that of the primary site.

1. takes into account any links and interdependencies to users, critical utilities and critical service providers, other central securities depositories means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014; and other market infrastructures;

2. requires its ICT business continuity arrangements to ensure that the recovery time objective for their critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; shall not be longer than 2 hours.

1. trading can be resumed within or close to 2 hours of a disruptive incident means an incident as defined in Article 6, point (6), of Directive (EU) 2022/2555;;

2. the maximum amount of data that may be lost from any IT service of the trading venue means a trading venue as defined in Article 4(1), point (24), of Directive 2014/65/EU; after a disruptive incident means an incident as defined in Article 6, point (6), of Directive (EU) 2022/2555; is close to zero.