According to point 32 of the draft guidelines the information security function shall be part of the second line of defence function. On the basis of its range of tasks and responsibilities the information security function should be part of the first line of defence function in our view. We ask the EBA to take this aspect into account.