Article 37 ICT systems acquisition, development, and maintenance

ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements, including information security requirements, are clearly specified and approved by the business function concerned;

ensure the testing and approval of ICT systems prior to their first use and before introducing changes to the production environment;

identify measures to mitigate the risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; of unintentional alteration or intentional manipulation of the ICT systems during development and implementation in the production environment.