Request for information

The Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation may, by simple request or by decision, require critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 to provide all information that is necessary for the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation to carry out its duties under this Regulation, including all relevant business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incidenta single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity reports, as well as any information relating to parties to whom the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 has outsourced operational functions or activities.

When sending a simple request for information under paragraph 1, the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation shall:

1. refer to this Article as the legal basis of the request;

2. state the purpose of the request;

3. specify what information is required;

4. set a time limit within which the information is to be provided;

5. inform the representative of the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 from whom the information is requested that he or she is not obliged to provide the information, but in the event of a voluntary reply to the request the information provided must not be incorrect or misleading.

When requiring by decision to supply information under paragraph 1, the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation shall:

1. refer to this Article as the legal basis of the request;

2. state the purpose of the request;

3. specify what information is required;

4. set a time limit within which the information is to be provided;

5. indicate the periodic penalty payments provided for in Article 35(6) where the production of the required information is incomplete or when such information is not provided within the time limit referred to in point (d) of this paragraph;

6. indicate the right to appeal the decision to ESA’s Board of Appeal and to have the decision reviewed by the Court of Justice of the European Union (Court of Justice) in accordance with Articles 60 and 61 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

The representatives of the critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 shall supply the information requested. Lawyers duly authorised to act may supply the information on behalf of their clients. The critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 shall remain fully responsible if the information supplied is incomplete, incorrect or misleading.

The Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation shall, without delay, transmit a copy of the decision to supply information to the competent authoritiesas defined in Article 46 of the financial entitiesas defined in Article 2, points (a) to (t) using the services of the relevant critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 and to the JONJoint Oversight Network .