1. the objectives of the ICT business continuity policy, including the interrelation of ICT and overall business continuity, and considering the results of the business impact analysis (BIA) referred to in Article 11(5) of Regulation (EU) 2022/2554;
2. the scope of the ICT business continuity arrangements, plans, procedures, and mechanisms, including limitations and exclusions;
3. the timeframe to be covered by the ICT business continuity arrangements, plans, procedures, and mechanisms;
4. the criteria to activate and deactivate ICT business continuity plans, ICT response and recovery plans, and crisis communications plans;

1. the governance and organisation to implement the ICT business continuity policy, including roles, responsibilities and escalation procedures ensuring that sufficient resources are available;
2. the alignment between the ICT business continuity plans and the overall business continuity plans, concerning at least all of the following:
   1. potential failure scenarios, including the scenarios referred to in Article 26(2) of this Regulation;
   2. recovery objectives, specifying that the financial entity shall be able to recover the operations of its critical or important functions after disruptions within a recovery time objective and a recovery point objective;
3. the development of ICT business continuity plans for severe business disruptions as part of those plans, and the prioritisation of ICT business continuity actions using a risk-based approach;
4. the development, testing and review of ICT response and recovery plans, in accordance with Articles 25 and 26 of this Regulation;
5. the review of the effectiveness of the implemented ICT business continuity arrangements, plans, procedures and mechanisms, in accordance with Article 26 of this Regulation;
6. the alignment of the ICT business continuity policy to:
   1. the communication policy referred to in Article 14(2) of Regulation (EU) 2022/2554;
   2. the communication and crisis communication actions referred to in Article 11(2), point (e), of Regulation (EU) 2022/2554.

1. ensure the continuity of critical or important functions of the central counterparty based on disaster scenarios;
2. maintain a secondary processing site capable of ensuring continuity of critical or important functions of the central counterparty identical to the primary site;
3. maintain or have immediate access to a secondary business site, to allow staff to ensure continuity of the service if the primary location of business is not available;
4. consider the need for additional processing sites, in particular where the diversity of the risk profiles of the primary and secondary sites does not provide sufficient confidence that the central counterparty’s business continuity objectives will be met in all scenarios.

For the purposes of point (a), central counterparties shall complete end of day procedures and payments on the required time and day in all circumstances.

For the purposes of point (c)(i), arrangements referred to in that point shall address the availability of adequate human resources, the maximum downtime of critical functions, and fail over and recovery to a secondary site.

For the purposes of point (c)(ii), the secondary processing site referred to in that point shall have a geographical risk profile which is distinct from that of the primary site.