Skip to the text
In this act Article 37 of 42
Text as of 15 Jul 2024 · Consolidated version of 25 June 2024 · Same wording as today’s text.Today’s text

Article 37 — ICT systems acquisition, development, and maintenance

Financial servicesLevel 2RTSDORAIn forceOfficial source

The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall design and implement, where appropriate, a procedure governing the acquisition, development, and maintenance of ICT systems following a risk-based approach. That procedure shall:

37(a)
a)ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements, including information security requirements, are clearly specified and approved by the business function concerned;
Copy link
37(b)
b)ensure the testing and approval of ICT systems prior to their first use and before introducing changes to the production environment;
Copy link
37(c)
c)identify measures to mitigate the risk of unintentional alteration or intentional manipulation of the ICT systems during development and implementation in the production environment.\
Copy link