Harmonization of conduct activities

Preamble (Recitals 1 – 14)

Recitals

Chapter I (Articles 1 – 2)

Information to be provided by ICT third-party service providers in the application for a voluntary request to be designed as critical

Article 1

Information to be provided by ICT third-party service provider in the application for a voluntary request to be designated as critical

Article 2

Assessment of completeness of application

Chapter II (Articles 3 – 6)

Information from critical ICT third-party service providers to the lead overseer

Article 3

Content of information provided by critical ICT third-party service providers

Article 4

Information from critical ICT third-party providers after the issuance of recommendations

Article 5

Structure and format of information provided by critical ICT third-party service providers

Article 6

Information on subcontracting arrangements provided by critical ICT third-party service providers

Chapter III (Article 7)

Competent authorities’ assessment of the measures taken by critical ICT third-party service providers based on recommendations of the lead overseer

Article 7

Competent authorities’ assessment of the risks addressed in the recommendations of the Lead Overseer

Chapter IV (Article 8)

Final provisions

Article 8

Entry into force

Article 4Note: This article is based on the final draft from the ESAs and is not yet adopted. Information from critical ICT third-party providers after the issuance of recommendations

  1. In accordance with Article 35(1), point (c), of Regulation (EU) 2022/2554 and as part of the notification to the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation of its intention to comply with the recommendations pursuant to Article 42(1) of that Regulation, the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 shall provide to the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation a remediation plan outlining the actions and remedies that the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 plans to implement in order to mitigate the risks identified in the recommendations. The remediation plan shall be consistent with the timeline set by the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation for each recommendation.

  2. To enable the monitoring of the implementation of the actions that have been taken or the remedies that have been implemented by the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 in relation to the recommendations received, the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 shall share with the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation upon request:

    1. interim progress reports and related supporting documents specifying the progress of the implementation of the actions and measures set out in the remediation plan provided by the critical ICT third party provider to the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation within the timeline defined by the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;

    2. final reports and related supporting documents specifying the actions that have been taken or the remedies that have been implemented by the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 in order to mitigate the risks identified in the recommendations received.

Table of contents