EveryAILaw.com

Requirements at a glance

This regulation imposes 9 specific requirements for Risk Assessment across 2 provisions:

• ICT risk management framework — Comprehensive framework for identifying, assessing, and mitigating ICT risks
• Governance — Management body must approve and oversee the ICT risk management framework
• Business continuity — Establish ICT business continuity and disaster recovery plans
• Cyber risk management — Address cybersecurity risks as part of the ICT risk framework
• Contractual requirements — Key contractual provisions for ICT third-party service agreements
• Concentration risk — Assess and manage concentration risk from third-party ICT dependencies
• Critical provider oversight — Designated critical third-party providers (CTPPs) subject to ESA oversight
• Exit strategies — Maintain exit strategies for critical ICT third-party services
• Register of Information — Maintain and keep up-to-date a register of information on all ICT third-party contractual arrangements, and submit it to competent authorities upon request or as required (DORA Article 28)