(3)Pursuant to Article 28(1), point (b), of Regulation (EU) 2022/2554, the financial entities’ management of ICT third-party risks is to take into account the nature, scale, complexity and importance of ICT-related dependencies, and the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers. That risk assessment should take into account the criticality or importance of the service, process or function of the financial entity and the potential impact on the continuity and availability of financial services and activities, at entity level and at group level.