Maintain comprehensive, documented, tested and reviewed exit plans

Manage ICT third-party risk as integral component of ICT risk management

Remain fully responsible for compliance despite third-party arrangements

Implement ICT third-party risk management proportionally

Adopt and regularly review ICT third-party risk strategy

Include policy on critical/important ICT services in third-party risk strategy

Management body regular risk review for critical/important functions

Maintain and update register of ICT service contractual arrangements

Appropriately document contractual arrangements with distinction

Report yearly on new ICT service arrangements

Make register available to competent authority upon request