Article 25 Testing of the ICT business continuity plans

When testing the ICT business continuity plans in accordance with Article 11(6), of Regulation (EU) 2022/2554, financial entitiesas defined in Article 2, points (a) to (t) shall take into account the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;’s business impact analysis (BIAbusiness impact analysis) and the ICT risk means any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; assessment referred to in Article 3(1), point (b), of this Regulation.

1. be performed on the basis of test scenarios that simulate potential disruptions, including an adequate set of severe but plausible scenarios;

2. contain the testing of ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided by ICT third-party service providers means an undertaking providing ICT services;, where applicable;

3. for financial entitiesas defined in Article 2, points (a) to (t), other than microenterprises, ‘small enterprises’ and ‘medium-sized enterprises’ mean, respectively, microenterprises, small enterprises and medium-sized enterprises as defined in the Annex to Recommendation 2003/361/EC;, as referred to in Article 11(6), second subparagraph, of Regulation (EU) 2022/2554, contain scenarios of switchover from primary ICT infrastructure to the redundant capacity, backups and redundant facilities;

4. be designed to challenge the assumptions on which the business continuity plans are based, including governance arrangements and crisis communication plans;

5. contain procedures to verify the ability of the financial entitiesas defined in Article 2, points (a) to (t)’ staff, of ICT third-party service providers means an undertaking providing ICT services;, of ICT systems, and ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; to respond adequately to the scenarios duly taken into account in accordance with Article 26(2).

For the purposes of point (a), financial entitiesas defined in Article 2, points (a) to (t) shall always include in the testing the scenarios considered for the development of the business continuity plans.

For the purposes of point (b), financial entitiesas defined in Article 2, points (a) to (t) shall duly consider scenarios linked to insolvency or failures of the ICT third-party service providers means an undertaking providing ICT services; or linked to political risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; in the ICT third-party service providers means an undertaking providing ICT services;’ jurisdictions, where relevant.

For the purposes of point (c), the testing shall verify whether at least critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; can be operated appropriately for a sufficient period of time, and whether the normal functioning may be restored.

1. clearing members;

2. external providers;

3. relevant institutions in the financial infrastructure with which central counterparties means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012; have identified interdependencies in their business continuity policies.

1. users of the central securities depositories means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;;

2. critical utilities and critical service providers;

3. other central securities depositories means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;;

4. other market infrastructures;

5. any other institutions with which central securities depositories means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014; have identified interdependencies in their business continuity policy.

Financial entitiesas defined in Article 2, points (a) to (t) shall document the results of the testing referred to in paragraph 1. Any identified deficiencies resulting from that testing shall be analysed, addressed, and reported to the management body means a management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council (^31^), Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law; Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32)..