ESMA shall put in place an effective and proportionate IT security policy for ESAP and shall ensure appropriate levels of authenticity, availability, integrity and non-repudiation of the information made accessible on ESAP and of the protection of personal data. ESMA may carry out periodic reviews of the IT security policy and the cybersecurity situation of ESAP in the light of evolving international and Union cybersecurity trends and latest developments.