For the purposes of point (b) of Article 59(3), the operator or aircraft operator shall ensure that the information technology system is designed, documented, tested, implemented, controlled and maintained in a way to process reliable, accurate and timely data in accordance with the risks identified in accordance with point (a) of Article 59(2).

The control of the information technology system shall include access control, control of back up, recovery, continuity planning and security.