{
  "url": "https://openlegislation.uk/eu-regulation-2017-392/article-77",
  "json_url": "https://openlegislation.uk/eu-regulation-2017-392/article-77.json",
  "legislation": "eur/2017/392",
  "legislation_title": "Commission Delegated Regulation (EU) 2017/392 of 11 November 2016 supplementing Regulation (EU) No 909/2014 of the European Parliament and of the Council with regard to regulatory technical standards on authorisation, supervisory and operational requirements for central securities depositories (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2017-392",
  "path": "article/77",
  "kind": "article",
  "number": "77",
  "heading": "Business impact analysis",
  "text": "1. A CSD shall conduct a business impact analysis to:\n(a) prepare a list with all the processes and activities that contribute to the delivery of the services it provides;\n(b) identify and create an inventory of all the components of its IT system that support the processes and activities identified in point (a) as well as their respective interdependencies;\n(c) identify and document qualitative and quantitative impacts of a disaster recovery scenario to each process and activity referred to in point (a) and how the impacts change over time in case of disruption;\n(d) define and document the minimum service levels considered acceptable and adequate from the perspective of the users of the CSD;\n(e) identify and document the minimum resource requirements concerning personnel and skills, work space and IT to perform each critical function at the minimum acceptable level.\n2. A CSD shall conduct a risk analysis to identify how various scenarios affect the continuity of its critical operations.\n3. A CSD shall ensure that its business impact analysis and risk analysis fulfil all of the following requirements:\n(a) they are kept up to date;\n(b) they are reviewed following a material incident or significant operational changes and, at least, annually;\n(c) they take into account all relevant developments, including market and IT developments.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2017/392/article/77",
    "retrieved_at": "2026-11-01T14:45:08.676264+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}