Content of the scope specification document (Article 9(6))
ANNEX IISupplementary provisions
ANNEX II Content of the scope specification document (Article 9(6)) 1. The scope specification document shall contain a list of all critical or important functions identified by the financial entity. 2. For each identified critical or important function, the following information shall be included: (a) where the critical or important function is not included in the scope of the TLPT, the explanation of the reasons for which it is not included; (b) where the critical or important function is included in the scope of the TLPT: (i) the explanation of the reasons for its inclusion; (ii) the identified ICT system(s) supporting that critical or important function; (iii) for each identified ICT system: 1. whether it is outsourced and if so, the name of the ICT third party service provider; 2. the jurisdictions in which the ICT system is used; 3. a high-level description of preliminary flag(s), indicating which security aspect of confidentiality, integrity, authenticity or availability is covered by each flag.