Article 21 2

(a)

the identification and classification of key roles, including accountability for decision-making within the organisation, processes, operations, services, and information assets that support the SIPS’s critical operations and services in order to ensure that appropriate measures are in place for their protection and timely recovery in the event of a cyber attack;

(b)

the adequate protection of the SIPS from cyber risks, including by implementing effective security controls and conducting control activities on the functioning and security of main ICT systems, processing or storing sensitive information;

(c)

the timely and appropriate detection of any cyber incident or signs of it, including through the monitoring of anomalous activities;

(d)

the response to and recovery from any cyber incident or any adverse event in a timely and appropriate manner, enabling the SIPS to resume critical operations rapidly and in a way that limits any damage to the SIPS.