The criteria for assessing whether the control and safeguard arrangements for information processing systems of an external reviewer are effective, as referred to in Article 30(2) of Regulation (EU) 2023/2631, shall be the following:
((a))
a control and safeguard structure is implemented which:
((i))
is appropriate to the nature, scale and complexity of the external reviewer;
((ii))
ensures an effective and prudent management of ICT risks;
((b))
there is an effective and prudent management of ICT risks which includes:
((i))
security assessments of ICT and information systems at least once every 24 months;
((ii))
maintenance and testing of redundant ICT capacities to ensure continuity of the business;
((iii))
risk assessments of third-party ICT integration, where applicable.