Staff with privileged or administrative access to the application complete cybersecurity awareness training at least annually.

An up-to-date asset inventory exists for all hardware and software components of the application.

Penetration testing is performed at least annually, or after major changes, to assess the effectiveness of implemented controls.

Backups are encrypted, tested for restorability, and stored in a geographically separate location.

Security incidents involving the application can be escalated to support the 24-hour early-warning notification deadline under Article 23.

Role-based access control is implemented and access is provisioned on a least-privilege basis.

Direct suppliers and service providers supporting this application are risk-assessed for cybersecurity practices prior to onboarding.