10.2.2. For the purpose of point 10.2.1, the relevant entities shall: (a) put in place criteria …

(a)

put in place criteria, which set out which roles, responsibilities and authorities shall only be exercised by persons whose background has been verified;

(b)

ensure that verification referred to in point 10.2.1 is performed on these persons before they start exercising these roles, responsibilities and authorities, which shall take into consideration the applicable laws, regulations, and ethics in proportion to the business requirements, the asset classification as referred to in point 12.1 and the network and information systems to be accessed, and the perceived risks.