Pursuant to Article 28(1), point (b) of Regulation (EU) 2022/2554, the financial entities’ management of ICT third-party risksan ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements takes into account the nature, scale, complexity and importance of ICT-related dependencies, as well as the risks arising from contractual arrangements on the use of ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services concluded with ICT third-party service providersan undertaking providing ICT services. This should take into account the criticality or importance of the service, process or function and the potential impact on the continuity and availability of financial services and activities, at entity and at groupa group as defined in Article 2, point (11), of Directive 2013/34/EU level.