09.04.01/2009/000776

• 23 pages
• Restricted
• January 13, 2009

Introduction

Like all large-scale programmes, the T2S programme consists of a huge number of activities that will have to be conducted in a “flexible order”, involving many different stakeholders and resulting in a series of deliverables that will lead to the successful launch of the T2S system, currently scheduled for Q2 2013.

In order to allow all stakeholders to get a general overview of the various activities and deliverables, it
is proposed to split the programme into 9 core workstreams: (I) governance, (II) user requirements,
(III) functional specifications, (IV) non-functional specifications, (V) technical infrastructure, (VI)
financial framework, (VII) legal framework, (VIII) testing & migration and (IX) information security
management. Each of these workstreams is expected to result in a few deliverables, the majority of
which require input from other workstreams and/or are input for other workstreams1.
In addition to these, there are two supporting workstreams that do not result in any significant
deliverables that can be scheduled as part of a master plan, but which imply continuous efforts and
indirectly are of crucial importance in order to keep all activities on track and to keep all stakeholders
involved.

The first of these supporting workstreams consists in co-ordinating all other workstreams, in a way that
keeps the overall process consistent. These activities, such as programme planning, budget monitoring,
resource planning, quality management, project risk management etc. are performed by a Project
office.

The second workstream consists in continuously informing all stakeholders, both direct (future) users
of T2S, and associations and authorities that play an important role in keeping the momentum and in
creating an environment of moral suasion for CSDs and their participants to join T2S. The tools
commonly used to do this are speeches, bilateral contacts with CSDs, newsletters, information reports
to the Governing Council, regulators, governmental bodies etc., special information seminars for CSD
participants etc.

In addition to the 9 core and the 2 supporting workstreams, attention is drawn to two value adding
workstreams, i.e. harmonisation and non-euro business. These are no project requirements since T2S
can be delivered without independently from these activities. However, if there are requests from those
two processes, this may have a significant impact on the majority of the core and supporting
workstreams, given their inherently transversal nature.

This note aims at presenting only the core workstreams and deliverables and at proposing the most
optimal timelines for each of them, taking into account their interdependencies and the expected
resources. The table in annex 1 gives a synoptic overview of the most important issues presented in this
note. Annex 2 gives a detailed overview of all deliverables identified so far.

The objective is that this note is further enhanced later, e.g. by also describing the objectives and main
deliverables of the supporting and value adding workstreams, and by complementing it with a draft
master plan.

It is important to note that the dates mentioned in this document are the result of careful considerations
and planning exercises that have taken place in recent months. Nevertheless, they have to be taken as
indicative dates, since continuous attempts are being made (and will continue to be made throughout
the project phase) to further optimise the different processes and their interrelations. Thus they are of
indicative and not of a legally binding nature.

…

6. Workstream VI: Financial framework

6.1 General objectives

In terms of financial flows between stakeholders, the set-up of the T2S project is a two-stage concept.
On the one hand, the 4CB will make a cost assessment on the basis of the first stable version of the
GFS, which will be charged to the Eurosystem on the basis of a schedule still to be defined. On the
other hand, the CSDs will outsource their settlement activity to the Eurosystem, who will use T2S
(procured from the 4CB) to provide the (technical) settlement services to the CSDs. The latter will pay
a price to the Eurosystem on the basis of a pricing scheme still to be defined. Consequently, from the
Eurosystem’s perspective, there are two separate financial processes, which are formally completely
separated, even if economically both are expected to match (taking into account the ECB’s own costs):
the compensation to be paid to 4CB for providing and operating T2S, and the fees to be received from
the CSDs for the provision of the (technical) settlement services.
6.2 Main deliverables and interdependencies

On the procurement side, the main deliverable is the (conditional final) offer from 4CB. The input
needed to finalise this are the GFS. In addition, in order to reassure the Eurosystem that the 4CB costs
(which are the basis for this offer) are calculated according to the common ESCB methodology, an
audit is expected to be organised, the result of which will be a report to the ECB Governing Council.
This report may result in some amendments to the offer from 4CB, before it is accepted by the
Eurosystem, and can be attached to the contract with the 4CB.

On the selling side, the main deliverable is the pricing scheme, which will need to be integrated in the
legal arrangements with the CSDs. Most likely, this scheme will not be developed from scratch, but on
the basis of a pricing policy, that will need to be discussed with the market and approved by the ECB
Governing Council. In addition, the scheme cannot be developed before clarity has been provided
about (i) the real final cost, i.e. the price to be paid to 4CB and the Eurosystem’s own costs and (ii) a
detailed list of the services that have to be priced. For the policy note no specific input is expected from
other workstreams or deliverables. For the pricing scheme up-to-date volumetric assumptions are
needed.

As soon as the pricing scheme (and its detailed implementation) is finalised, the billing specifications
(for the invoices to be sent to the CSDs) should also be finalised. In case the decision is made to
integrate these specifications into the T2S application, 4CB will need to develop the software.
Alternatively, it could be decided to buy a billing software, which would result in a procurement
procedure. In any case, the billing application will need to go through a testing phase, before it can
actually be used.

6.3 Timing

Together with the finalisation of the GFS by March 2009 or shortly after, the 4CB are expected to
present their conditional final offer to the ECB, which should be accepted by mid 2009, on the basis of
an audit report.

…

7. Workstream VII: Legal framework

7.1 General objectives

The overall T2S legal framework will consist of a multifacetted approach. The CSDs (and non-euro
NCBs) will enter into a contractual relationship with the Eurosystem, specifying the mutual rights,
obligations, expectations and liabilities. This will be complemented by the Eurosystem internal legal
set-up, which will define the attribution of tasks within the Eurosystem, in particular as regards the
4CB. These external and Eurosystem internal legal arrangements will to a large degree have to follow a
back-to-back concept: the obligations regarding the provision of T2S services by the Eurosystem to the
CSDs will have to be backed by similar obligations of the 4CB towards the Eurosystem.
7.2 Main deliverables and interdependencies

Towards the CSDs, it is envisaged to have two steps: first the legal arrangement for the specification
and development phase, together with some fundamental aspects that will apply to the production
phase; then at the latest before the start of the migration phase, the legal arrangements for the
production phase will have to be finalised. The drafting of the legal arrangements is dependent on input
expected from a number of other workstreams/deliverables. For the specification and development
phase, this concerns mainly the Eurosystem internal governance, the general features of the pricing
scheme and the programme management/programme plan including the identification of key
milestones. This in turn requires delivery of GS, the GFS, the UR/GFS change management
procedures, the 4CB project schedule and the conditional final offer. For the legal arrangement for the
operational phase, final versions of all these deliverables will be needed, in particular the UDFS, the
final financial offer, the Service Level Agreement, the release management procedures and the T2S
security framework.

The legal framework for T2S will have to be complemented by the Eurosystem internal legal
arrangements necessary to define the Eurosystem internal allocation of tasks and responsibilities.
Finally additional legal arrangements will have to be established, e.g. in relation to non-euro NCBs or
third party service providers.

7.3 Timing

The legal arrangements for the specification and development phase, both regarding the CSDs and the
Eurosystem internal arrangements (including with the 4CB) are scheduled for Q1 2009, pending the
input from the various other workstreams; while the contracts for the operational phase can be finalised
shortly before the start of the user tests, e.g. by Q3 2012.

…

9. Workstream IX: Information security management

9.1 General objectives

The objectives of the workstream on information security management are to ensure that T2S will be
managed and operated in accordance with international standards in terms of confidentiality, integrity
and availability of information no matter which form it takes (e.g. stored electronically, transmitted
across networks). The ECB and 4CB have agreed on a IS management framework based on the
internationally recognised standard ISO 27002/177995. It first identifies the “sources of risk” (in the
form of a risk analysis) to the asset information, and then chooses the appropriate response to these
threats, called “security controls”.

This “risk-control” relationship is consistently used throughout the risk management process. Standard
security controls are assigned to the sources of risk they are addressing. It is then checked whether the
specified security controls are implemented and effective. Subsequently the risks associated with any
non-compliance are being estimated in terms of likelihood (probability) and impact (consequences).
The reporting mechanism brings the outcome of the risk assessment to the attention of the system
owner and asks for a decision (risk acceptance or risk mitigation).

9.2 Main deliverables and interdependencies

There are mainly four deliverables that are expected to come out of this workstream. First, the T2S
information security policy is needed, specifying the scope of the system that will be subject to the IS
management framework and defining other guiding principles related to risk management. Apart from
the user requirements and governance, no particular input is needed from other workstreams, but it
forms the basis for the second deliverable, i.e. the security requirements and controls. Once this is
completed, the general technical design (and other general – particularly non-functional –
specifications) can be finalised. On the basis of the security requirements and controls, the 4CB will
prepare the risk analysis, which indicates the controls that are actually in place and the estimated risk
associated with any non-compliance. This is then input for the security assessment report, to be
performed by the ECB, in co-operation with 4CB, and which will result in a comprehensive and
structured overview of the risk situation that is to be submitted to the ECB Governing Council. If any
risks are identified, action will be proposed through the decision making process whether a risk should
be further mitigated or can be accepted.

Share this: