ANNEX II
Content of the scope specification document (Article 9(6))
1.
The scope specification document shall contain a list of all critical or important functions identified by the financial entity.
2.
(a) | where the critical or important function is not included in the scope of the TLPT, the explanation of the reasons for which it is not included; |
(b) | where the critical or important function is included in the scope of the TLPT: the explanation of the reasons for its inclusion; the identified ICT system(s) supporting that critical or important function; for each identified ICT system: whether it is outsourced and if so, the name of the ICT third party service provider; the jurisdictions in which the ICT system is used; a high-level description of preliminary flag(s), indicating which security aspect of confidentiality, integrity, authenticity or availability is covered by each flag. |