(16)ESAP could be subject to confidentiality breaches, integrity risks and risks related to its own availability and the availability of the information processed therein. Those risks include accidents, errors, deliberate attacks and natural events, and need to be recognised as operational risks. ESMA and the collection bodies should implement appropriate and proportionate policies, including regular reviews, to ensure that ESAP protects the information processed and functions to the highest appropriate standard.