(22)When developing an ICT business continuity policy, financial entities referred to in Title II of this Regulation should take into account the essential components of ICT risk management, including ICT-related incident management and communication strategies, the ICT change management process, and risks associated with ICT third-party service providers.