Is your firm based in the EU and/or offers services in the EU?

Does your company fall in one of the following categories of financial services firms?

Does your company provide ICT services to financial entities within or outside the EU?

Do you have written and documented contract(s) for the ICT services you are receiving/providing?

Do you have ICT contracts supporting ‘critical or important functions’ – areas which if disrupted, the performance of the financial entity would be severely impaired?

Do you have an ICT system setup with the purpose and intention of mitigating against cyber risks and service deterioration?

Do you have a system in place that allows you to continuously monitor risks originating from relying on crucial providers?

Do you have a system in place that allows you to monitor and log ICT-related incidents?

(Please select all applicable) Has your company demonstrated robust controls around third party management by:

Does your company share information such as the intelligence of threats they receive or cyber security information, with regulators and other financial institutions?