Article 16 ICT systems acquisition, development, and maintenance

1. identify security practices and methodologies relating to the acquisition, development, and maintenance of ICT systems;

2. require the identification of:

   1. technical specifications means a technical specification as defined in Article 2, point (4), of Regulation (EU) No 1025/2012; and ICT technical specifications means a technical specification as defined in Article 2, point (4), of Regulation (EU) No 1025/2012;, as defined in Article 2, points (4) and (5), of Regulation (EU) No 1025/2012;

   2. requirements relating to the acquisition, development, and maintenance of ICT systems, with a particular focus on ICT security requirements and on their approval by the relevant business function and ICT asset means a software or hardware asset in the network and information systems used by the financial entity; owner in accordance with the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;’s internal governance arrangements;

3. specify measures to mitigate the risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; of unintentional alteration or intentional manipulation of the ICT systems during the development, maintenance, and deployment of those ICT systems in the production environment.

Financial entitiesas defined in Article 2, points (a) to (t) shall develop, document, and implement an ICT systems’ acquisition, development, and maintenance procedure for the testing and approval of all ICT systems prior to their use and after maintenance, in accordance with Article 8(2), point (b), points (v), (vi) and (vii). The level of testing shall be commensurate to the criticality of the business procedures and ICT assets means a software or hardware asset in the network and information systems used by the financial entity; concerned. The testing shall be designed to verify that new ICT systems are adequate to perform as intended, including the quality of the software means the part of an electronic information system which consists of computer code; developed internally.

1. clearing members and clients;

2. interoperable central counterparties means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;;

3. other interested parties.

1. users;

2. critical utilities and critical service providers;

3. other central securities depositories means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;;

4. other market infrastructures;

5. any other institutions with which central securities depositories means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014; have identified interdependencies in their business continuity policy.

1. identify and analyse vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; and anomalies in the source code;

2. adopt an action plan to address those vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; and anomalies;

3. monitor the implementation of that action plan.

The procedure referred to in paragraph 2 shall contain security testing of software means the part of an electronic information system which consists of computer code; packages no later than at the integration phase, in accordance with Article 8(2), points (b)(v), (vi) and(vii).

1. non-production environments only store anonymised, pseudonymised, or randomised production data;

2. financial entitiesas defined in Article 2, points (a) to (t) are to protect the integrity and confidentiality of data in non-production environments.

By way of derogation from paragraph 5, the procedure referred to in paragraph 2 may provide that production data are stored only for specific testing occasions, for limited periods of time, and following the approval by the relevant function and the reporting of such occasions to the ICT risk means any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment; management function.

The procedure referred to in paragraph 2 shall contain the implementation of controls to protect the integrity of the source code of ICT systems that are developed in-house or by an ICT third-party service provider means an undertaking providing ICT services; and delivered to the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; by an ICT third-parties service provider means an undertaking providing ICT services;.

The procedure referred to in paragraph 2 shall provide that proprietary software means the part of an electronic information system which consists of computer code; and, where feasible, the source code provided by ICT third-party service providers means an undertaking providing ICT services; or coming from open-source projects, are to be analysed and tested in accordance with paragraph 3 prior to their deployment in the production environment.

Paragraph 1 to 8 of this Article shall also apply to ICT systems developed or managed by users outside the ICT function, using a risk-based approach.