5.8 Information and communication technologies

1. Overview

Summary	Regulation
137. Competent authorities should assess whether the investment firm has sound, effective and …	Competent authorities should assess whether the investment firm has sound, effective and reliable information systems and whether their internal control functions have appropriate IT systems and support at their disposal with access to the internal and external information necessary to meet their responsibilities.
138. In particular, competent authorities should assess whether the investment firm is able to …	In particular, competent authorities should assess whether the investment firm is able to safeguard the security of its network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets.
139. Competent authorities should assess whether the information systems effectively support the …	Competent authorities should assess whether the information systems effectively support the investment firm’s business and risk management.

Requirements
Source	Requirement

Standards
Source	Requirement

EBA -
EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.