Article 21 1

1.   A SIPS operator shall establish a comprehensive cyber resilience framework with appropriate governance measures that enables it to effectively and efficiently manage cyber risks, and a cyber resilience strategy that takes into account the risk tolerance and risk appetite of the SIPS operator.