(Article 17(1) of Directive 2014/65/EU)
1. An investment firm shall implement an IT strategy with defined objectives and measures which:
(a) is in compliance with the business and risk strategy of the investment firm and is adapted to its operational activities and the risks to which it is exposed;
(b) is based on a reliable IT organisation, including service, production, and development;
(c) complies with an effective IT security management.
2. An investment firm shall set up and maintain appropriate arrangements for physical and electronic security that minimise the risks of attacks against its information systems and that includes effective identity and access management. Those arrangements shall ensure the confidentiality, integrity, authenticity, and availability of data and the reliability and robustness of the investment firm's information systems.
3. An investment firm shall promptly inform the competent authority of any material breaches of its physical and electronic securi
…