Contents
Article 13Security requirements#
1.IIPs and RRMs shall set up and maintain policies, procedures and arrangements for physical and electronic security which are based on best practices, and which are consistent with internationally recognised standards. Those policies, procedures and arrangements shall be designed to:
(a)protect the IT systems of the IIPs and RRMs from misuse or unauthorised access;
(b)minimise the risks of incidents against information systems, as defined in Article 6(6) of Directive (EU) 2022/2555 of the European Parliament and of the Councilnote;
(c)prevent unauthorised disclosure of confidential information flowing from IIP clients and RRM clients to the IIP or RRM and from the IIP or RRM to the Agency;
(d)ensure the confidentiality, integrity, availability, authenticity, accountability and reliability of the information processed within the IIP’s and RRM’s systems and, for IIPs, prevent leakages of the processed information before its publication;
(e)ensure non-repudiation through electronic signatures or certificates, or through any other mechanisms that provide an equivalent level of non-repudiation.
2.IIPs and RRMs shall establish the requirements for data access permissions as well as the purpose and the scope of data access, and any restrictions on the use of the data. They shall set up and maintain security mechanisms to promptly identify and manage the risks referred to in paragraph 1, including the following:
(a)a secure environment for the collection and management of data from IIP clients and RRM clients and for the submission of inside information reports and reporting of data records to the Agency;
(b)application interfaces as specified by the Agency;
(c)a protected and segregated network connection with the Agency as specified by the Agency.
3.Applicants may demonstrate compliance with the physical and electronic security requirements referred to in paragraph 1 through submission to the Agency of a valid ISO/IEC 27000 standard series certificate on information security management systems or equivalent certifications. The Agency may ask the applicants for further clarifications regarding the certification provided and for an update of such certification after its expiration date.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.