# Commission Delegated Regulation (EU) 2017/392 of 11 November 2016 supplementing Regulation (EU) No 909/2014 of the European Parliament and of the Council with regard to regulatory technical standards on authorisation, supervisory and operational requirements for central securities depositories (Text with EEA relevance), Article 77: Business impact analysis

Extent: E+W+S+N.I.

1. A CSD shall conduct a business impact analysis to:
(a) prepare a list with all the processes and activities that contribute to the delivery of the services it provides;
(b) identify and create an inventory of all the components of its IT system that support the processes and activities identified in point (a) as well as their respective interdependencies;
(c) identify and document qualitative and quantitative impacts of a disaster recovery scenario to each process and activity referred to in point (a) and how the impacts change over time in case of disruption;
(d) define and document the minimum service levels considered acceptable and adequate from the perspective of the users of the CSD;
(e) identify and document the minimum resource requirements concerning personnel and skills, work space and IT to perform each critical function at the minimum acceptable level.
2. A CSD shall conduct a risk analysis to identify how various scenarios affect the continuity of its critical operations.
3. A CSD shall ensure that its business impact analysis and risk analysis fulfil all of the following requirements:
(a) they are kept up to date;
(b) they are reviewed following a material incident or significant operational changes and, at least, annually;
(c) they take into account all relevant developments, including market and IT developments.

---
Source: https://www.legislation.gov.uk/eur/2017/392/article/77 (the official version)
Page: https://openlegislation.uk/eu-regulation-2017-392/article-77
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.