Article 49Financial cross-sector exercises, communication and cooperation
1. The ESAs, through the Joint Committee and in collaboration with competent authorities, resolution authorities as referred to in Article 3 of Directive 2014/59/EU, the ECB, the Single Resolution Board as regards information relating to entities falling under the scope of Regulation (EU) No 806/2014, the ESRB and ENISA, as appropriate, may establish mechanisms to enable the sharing of effective practices across financial sectors to enhance situational awareness and identify common cyber vulnerabilities and risks across sectors.
They may develop crisis management and contingency exercises involving cyber-attack scenarios with a view to developing communication channels and gradually enabling an effective coordinated response at Union level in the event of a major cross-border ICT-related incident or related threat having a systemic impact on the Union’s financial sector as a whole.
Those exercises may, as appropriate, also test the financial sector’s dependencies on other economic sectors.
2. Competent authorities, ESAs and the ECB shall cooperate closely with each other and exchange information to carry out their duties pursuant to Articles 47 to 54. They shall closely coordinate their supervision in order to identify and remedy breaches of this Regulation, develop and promote best practices, facilitate collaboration, foster consistency of interpretation and provide cross-jurisdictional assessments in the event of any disagreements.
DORA, the European Union regulation on digital operational resilience, Article 49
Cross-sector exercises and coordination. The ESAs, through the Joint Committee and in collaboration with competent authorities, resolution authorities, the ECB, the Single Resolution Board (for entities within its remit), the ESRB and ENISA, may set up mechanisms for sharing effective practices across financial sectors. The aim is better situational awareness and identifying common cyber vulnerabilities and risks.
They may also develop crisis management and contingency exercises using cyber-attack scenarios, to build communication channels and, step by step, an effective coordinated Union-level response to a major cross-border ICT-related incident or threat with systemic impact on the financial sector. Those exercises may also test the financial sector’s dependencies on other economic sectors.
Competent authorities, the ESAs and the ECB must cooperate closely and exchange information to perform their duties under Articles 47 to 54. They must coordinate supervision to identify and remedy breaches, develop and promote best practices, foster consistency of interpretation and provide cross-jurisdictional assessments where they disagree.
Nothing here obliges an entity to take part. The paragraph is about how authorities prepare and coordinate among themselves.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.