The package includes four draft regulatory technical standards (RTS), one set of draft implementing technical standards (ITS) and two sets of guidelines (GL). 

These policy instruments aim to ensure a "consistent and harmonised legal framework in the areas of major ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and oversight over critical ICT third-party providers."

Comments on this consultation can be sent to the ESAs via the consultation pages:

• Consultation on Joint draft technical standards on major incident reporting
• Consultation on Joint draft Guidelines on estimation of aggregated annual costs and losses caused by major ICT-related incidents
• Consultation on Joint draft RTS on subcontracting ICT services supporting critical or important functions
• Consultation on Joint draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities
• Consultation on Joint draft guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities
• Consultation on Joint draft RTS specifying elements related to threat led penetration tests 

The consultation runs until 4 March 2024.