Article 37 ICT systems acquisition, development, and maintenance

Summary What does Article 37 of the RTS on ICT risk management framework say?

This article applies specifically to the financial entities subject to the simplified ICT risk management framework under Article 16(1) of DORA.

It requires those entities to put in place a procedure for how they acquire, develop, and maintain ICT systems, following a risk-based approach.

The procedure must address three core areas: pre-acquisition requirements gathering, testing and approval before go-live, and safeguards against tampering during development and deployment.

Important points:

Design and implement a procedure for the acquisition, development, and maintenance of ICT systems using a risk-based approach.
Ensure that functional, non-functional, and information security requirements are specified and approved by the relevant business function before any acquisition or development begins.
Put measures in place to protect ICT systems from unintentional alteration or intentional manipulation during development and production deployment.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall design and implement, where appropriate, a procedure governing the acquisition, development, and maintenance of ICT systems following a risk-based approach. That procedure shall:

ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements, including information security requirements, are clearly specified and approved by the business function concerned;
ensure the testing and approval of ICT systems prior to their first use and before introducing changes to the production environment;
identify measures to mitigate the risk of unintentional alteration or intentional manipulation of the ICT systems during development and implementation in the production environment.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.