Article 20 5

5.   A SIPS operator shall establish comprehensive physical and information and communication technology (ICT) security policies, processes and system policies, as well as resilient information systems, that adequately identify, assess and manage all potential vulnerabilities, threats, incidents and risks in an ICT environment. It shall review the policies at least annually.