Structure of the Oversight Framework

The Joint Committeethe committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, in accordance with Article 57(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, shall establish the Oversight Forum as a sub- committee for the purposes of supporting the work of the Joint Committeethe committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 and of the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation referred to in Article 31(1), point (b), in the area of ICT third-party riskan ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements across financial sectors. The Oversight Forum shall prepare the draft joint positions and the draft common acts of the Joint Committeethe committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 in that area.

The Oversight Forum shall regularly discuss relevant developments on ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment and vulnerabilitiesa weakness, susceptibility or flaw of an asset, system, process or control that can be exploited and promote a consistent approach in the monitoring of ICT third-party riskan ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements at Union level.

The Oversight Forum shall, on a yearly basis, undertake a collective assessment of the results and findings of the oversight activities conducted for all critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 and promote coordination measures to increase the digital operational resiliencethe ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions of financial entitiesas defined in Article 2, points (a) to (t), foster best practices on addressing ICT concentration riskan exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole and explore mitigants for cross-sector risk transfers.

The Oversight Forum shall submit comprehensive benchmarks for critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 to be adopted by the Joint Committeethe committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 as joint positions of the ESAsEuropean Supervisory Authority in accordance with Article 56(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

The Oversight Forum shall be composed of:

1. the Chairpersons of the ESAsEuropean Supervisory Authority;

2. one high-level representative from the current staff of the relevant competent authorityas defined in Article 46 referred to in Article 46 from each Member State;

3. the Executive Directors of each ESAEuropean Supervisory Authority and one representative from the Commission, from the ESRB, from ECB and from ENISA as observers;

4. where appropriate, one additional representative of a competent authorityas defined in Article 46 referred to in Article 46 from each Member State as observer;

5. where applicable, one representative of the competent authoritiesas defined in Article 46 designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31, as observer.

The Oversight Forum may, where appropriate, seek the advice of independent experts appointed in accordance with paragraph 6.

Each Member State shall designate the relevant competent authorityas defined in Article 46 whose staff member shall be the high-level representative referred in paragraph 4, first subparagraph, point (b), and shall inform the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation thereof.

The ESAsEuropean Supervisory Authority shall publish on their website the list of high-level representatives from the current staff of the relevant competent authorityas defined in Article 46 designated by Member States.

The independent experts referred to in paragraph 4, second subparagraph, shall be appointed by the Oversight Forum from a pool of experts selected following a public and transparent application process.

The independent experts shall be appointed on the basis of their expertise in financial stability, digital operational resiliencethe ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions and ICT security matters. They shall act independently and objectively in the sole interest of the Union as a whole and shall neither seek nor take instructions from Union institutions or bodies, from any government of a Member State or from any other public or private body.

In accordance with Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the ESAsEuropean Supervisory Authority shall by 17 July 2024 issue, for the purposes of this Section, guidelines on the cooperation between the ESAsEuropean Supervisory Authority and the competent authoritiesas defined in Article 46 covering the detailed procedures and conditions for the allocation and execution of tasks between competent authoritiesas defined in Article 46 and the ESAsEuropean Supervisory Authority and the details on the exchanges of information which are necessary for competent authoritiesas defined in Article 46 to ensure the follow-up of recommendations pursuant to Article 35(1), point (d), addressed to critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31.

The requirements set out in this Section shall be without prejudice to the application of Directive (EU) 2022/2555 and of other Union rules on oversight applicable to providers of cloud computing services.

The ESAsEuropean Supervisory Authority, through the Joint Committeethe committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 and based on preparatory work conducted by the Oversight Forum, shall, on yearly basis, submit a report on the application of this Section to the European Parliament, the Council and the Commission.