Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx security xxxxxxxxxx xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx are xxxxxxxxxx xx xxxx participant, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx to xx. Xx xxxxxxxxxxxx xxx xxxxx xx xxxxxxxxxxx xx xxx requirements xxxxxx xxx infrastructure, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx involved xx the xxxxxxxx xx transactions (x.x. xxxxxxxxxxxx, front-office xxx xxxx-xxxxxx applications, xxxxxxxxxx), xxx ends xx xxx xxxxxx responsible xx send xxx xxxxxxx to SWIFT (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx the xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx xxx x&xxxx;xxxxx xxxxxx xxxxxxxxx in xxxx with business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx for and xxxxxxxxxx xx information xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx and xxxxxxxxxxx of an xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx at xxxxxxxx xxxxxxxxxxx xxxxxxxx and xxxxx resilience across xxx xxxxxxxxxxxx xx xxxxx xx identification, xxxxxxxxxx and xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx xxxxx resilience xxxxx. Xxx policy xxxxxx contain at xxxxx xxx following xxxxxxxx: objectives, scope (xxxxxxxxx xxxxxxx such xx organisation, xxxxx xxxxxxxxx, asset management xxx.), xxxxxxxxxx xxx xxxxxxxxxx xx responsibilities.

Requirement 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxxxx the xxxxxxxxxxx security policy xxxxxx xxx xxxxxxxxxxxx. Xxx management xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to ensure xxx implementation of xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx resources xxx xxxxxxxxxx xx security xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx xxx dependence xx, an xxxxxxxx xxxxx/xxxxxxx or products/services xxxxxxxx xx xxxx. Xxx xxxxxx to xxx organisation’s information xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx xxx required xx xxxxxx the xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx xx xxxxxxx xxx xx determine xxx security implications xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx shall be xxxxxx and defined xx an xxxxxxxxx xxxx each relevant xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, the business xxxxxxxxx and xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx user-developed xxxxxxxxxxxx, xx the xxxxx of the Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx accounted xxx and have x&xxxx;xxxxxxxxx owner. Xxx xxxxxxxxxxxxxx for xxx xxxxxxxxxxx xxx xxx xxxxxxxxx xx appropriate xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx related XX xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx assets xxxxx be xxxxxxxx. Xxxx: the xxxxx xxx delegate xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx appropriate, xxx remains xxxxxxxxxxx xxx the proper xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx classification

Information assets xxxxx be classified xx terms xx xxxxx xxxxxxxxxxx xx xxx smooth xxxxxxxx xx the xxxxxxx xx the xxxxxxxxxxx. Xxx classification xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx and degree xx xxxxxxxxxx xxxxxxxx xxxx handling xxx xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX components. An xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx approved by xxx management xxxxx xx xxxx xx xxxxxx an xxxxxxxxxxx xxx of protection xxxxxxxx throughout xxx xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx to xxxxxxxxxxx xxx xxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx responsibilities xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx and xx xxxxx and xxxxxxxxxx xx xxxxxxxxxx. All xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx and xxxxx xxxxx xxxxx xxxxx xx adequately screened, xxxxxxxxxx for xxxxxxxxx xxxx. Xxxxxxxxx, contractors xxx third xxxxx xxxxx of information xxxxxxxxxx xxxxxxxxxx shall xxxx an xxxxxxxxx xx xxxxx xxxxxxxx xxxxx and xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx awareness xxxxx xx ensured among xxx employees, xxxxxxxxxxx xxx third xxxxx xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx xxx xxx xxxxxxx use xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx be xxxxxxxx to xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Responsibilities xxxxx xx xx xxxxx xx ensure xxxx an xxxxxxxx’x, xxxxxxxxxx’x or third xxxxx user’s exit xxxx xx transfer xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, and xxxx xxx xxxxxx xx all equipment xxx xxx xxxxxxx xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Physical and xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx or xxxxxxxxx information processing xxxxxxxxxx xxxxx xx xxxxxx xx xxxxxx xxxxx, protected xx xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx appropriate xxxxxxxx xxxxxxxx xxx entry xxxxxxxx. Xxxx shall xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx be xxxxxxx xxxx xx xxxxxxxxxxx who xxxx xxxxxx the xxxxx xx Requirement 1.6. Xxxxxxxxxx and standards xxxxx be established xx xxxxxxx xxxxxxxx xxxxx containing xxxxxxxxxxx xxxxxx when xx xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx physical xxx xxxxxxxxxxxxx threats. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx xxxxxx xxx xxxx of xxxxxxxxxxxx xxxxxx to xxxxxxxxxxx xxx xx guard xxxxxxx xxxx xx xxxxxx of xxxxxxxxx xx information. Special xxxxxxxx may be xxxxxxxx to xxxxxxx xxxxxxx physical xxxxxxx xxx xx safeguard xxxxxxxxxx facilities xxxx xx the xxxxxxxxxx xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx established xxx the management xxx xxxxxxxxx of xxxxxxxxxxx processing facilities xxxxxxxx all xxx xxxxxxxxxx systems xx xxx Xxxxxxx Transaction Xxxxx end-to-end.

As regards xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx administration xx XX xxxxxxx, segregation xx xxxxxx xxxxx xx xxxxxxxxxxx, where xxxxxxxxxxx, to xxxxxx xxx risk xx xxxxxxxxx xx xxxxxxxxxx xxxxxx misuse. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx to xxxxxxxxxx xxxxxxxxx reasons, compensatory xxxxxxxx xxxxx be xxxxxxxxxxx following x&xxxx;xxxxxx xxxx xxxxxxxx. Controls xxxxx xx xxxxxxxxxxx xx prevent xxx xxxxxx xxx introduction xx malicious code xxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx shall xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Mobile xxxx xxxxx xx xxxx xxxx xxxx xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx configuration xx xxx xxxxxxx (e.g. xxx xxx xx xxxxxxxxxx and xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx and xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx by xxx management; xxxxx xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx xx xxx restoration xxxxxxx xxxxx xx tested xx regular intervals xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx xxx xxxxxxxx xx xxxxxxxx xxxxx xx monitored xxx xxxxxx xxxxxxxx to xxxxxxxxxxx xxxxxxxx xxxxx xx recorded. Xxxxxxxx xxxx xxxxx be xxxx to xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxxxxxx xx x&xxxx;xxxxxx basis, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. System xxxxxxxxxx xxxxx be xxxx xx xxxxx xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx identified xx critical xxx xxx security of xxxxxxxx xxx xx xxxxxx xxxxxxxxxx to xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx of information xxxxxxx organisations shall xx xxxxx xx x&xxxx;xxxxxx exchange xxxxxx, xxxxxxx xxx xx xxxx with xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx parties and xxxxx xx xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx in scenario 2 xx xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx used under x&xxxx;xxxxxx agreement xxxx xxx xxxxx party.

Requirement 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx assets xxxxx xx xxxxxxxxx xx xxx basis xx business xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) and according xx xxx established xxxxxxxxx xx corporate xxxxxxxx (including the xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx based xx xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx the xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Xxxxx xxxxxxxx (e.g. for xxxxxx xxxxxxxxxx) logical xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx are xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx place (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xx place xx xxxxxxx xxx allocation xx xxxxxx xxxxxx xx information systems xxx xxxxxxxx xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx stages xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx the initial xxxxxxxxxxxx xx xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx xx xxxxxx xxxxxxx access.

Special xxxxxxxxx xxxxx xx xxxxx, xxxxx appropriate, xx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx xxxxx xx those access xxxxxx xxxxx lead xx a severe xxxxxxx xxxxxx xx the xxxxxxxxxx xx the xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx of xxxxxx xxxxxxxx, xxxxxx xxxxxx xx business xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx xx identify, xxxxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx in xxx xxxxxxxxxxxx’x xxxxxxx, e.g. xxx xxxxx xxx xxxxxx access xx xxxxxxx in xxx Xxxxxxx Transaction Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx and enforced xx specific xxxxxxxx xx xxxxxx that xxxxxxxxx cannot xx xxxxxx guessed, x.x. xxxxxxxxxx xxxxx and xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx xxxxxxxx and/or xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx and xxxxxxxxxxx xx xxx xxx of xxxxxxxxxxxxx xxxxxxxx xx xxxxxxx xxx confidentiality, xxxxxxxxxxxx xxx integrity xx xxxxxxxxxxx. A key xxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxxx to support xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx policy xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx or xx xxxxx (e.g. x&xxxx;xxxxx screen, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx xxx xxxx xx unauthorised xxxxxx.

Xxxx xxxxxxx xxxxxxxx, the xxxxx xx working xx an xxxxxxxxxxx xxxxxxxxxxx shall xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx xxx organisational xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx identified xxx agreed prior xx the xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx xxxxxxxx xxxxx xxxxxxx the xxxxxxxxxx xx xxxxx xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx may be xxxxxxxx for systems xxxx xxxxxxx, xx xxxx xx xxxxxx xx, xxxxxxxxx, xxxxxxxx xx critical information. Xxxx controls xxxxx xx xxxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx and xxxx xxxxxxxxxx according xx xxx xxxxxxxxxxx xxxxxxxx (e.g. information xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx be xxxxxxxxxxx, documented xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx and xxx. Xx xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx secure management, xxxxxx be xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx data xxxxx and the xxxxx of xxxx xx xxx network xxxxx in xxx xxxxxxxxxxxx. There xxxxx xx specific controls xx protect xxxxxxxxx xxxxxxxxxxx passing xxxx xxxxxx networks.

Access xx xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx xx xxxxxxxxxx xxx XX xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Xxxx shall xx xxxxx xx xxxxx exposure xx xxxxxxxxx data xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. Deployment xx xxxxxxx xx xxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx xxxxx xxxxxxx xx be xxxxxxxx xx xxxxxxxxxx xxxxx xx conducted.

Regular xxxxxxxx testing xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx shall xxxx xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx security xxxxxxx xxxxx include, xx least, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx of xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx the security xxxxxxx xxxxxxxxxx xxxxx xx assessed xxx xxxxxx xxxxx to xxxxx xxx xxxxxxxxxx xxx shall be xxxxxxxx and xxxxxxxx xx in x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx ensure xxxxxxxxxx xx xxx participant’s xxxxxxxx information xxxxxxx xxxx xxx accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx risks xxxxxxxxxx with xxxxxxxx’x xxxxxx shall be xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx approach xx xxx xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx security xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx level, xxxxx xx xxxxxxxxxxx and xxxxxx to xxxxxx x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx and xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx pursued xx xx xxxxxxxx xxxxxxxx xx xx xx xxxxxxx). Xxxxxxxxx xxxxxxxx xx these xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx systems (x.x. xxxx office xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx network xxxxxxxxxxxx) xxxxx be xxxxxxxxx xxxxxxxx xxx xxxxxxxxxx xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework of xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx machines xxxxx comply xxxx xxx xxx security xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. hardening, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx the xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx patching, xxxxxx xxxxxxxxxx xx different xxxxxxxxxxxx (e.g. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx and xxxxxxxxxx as xxxx xx xxxxxxxx xx xxxxxx rights, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx accounts, shall xx xxxxxxxxxxx xxxxx xx a risk xxxxxxxxxx. Xxxxx virtual machines xxxxxxx xx xxx xxxx hypervisor xxxxx xxxx a similar risk xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx and/or hybrid xxxxx solutions in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx must be xxxxx xx a formal xxxx assessment, xxxxxx xxxx xxxxxxx the xxxxxxxxx xxxxxxxx and xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx that xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx the highest xxx xx xxx xxxxxxxxx systems. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx solutions xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (applicable only xx critical xxxxxxxxxxxx)

Xxx xxxxxxxxx requirements (2.1 xx 2.6) relate xx business continuity xxxxxxxxxx. Each XXXXXX2 xxxxxxxxxxx xxxxxxxxxx xx xxx Eurosystem as xxxxx xxxxxxxx xxx xxx smooth functioning xx xxx TARGET2 xxxxxx shall xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx following elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx plans xxxxx xx xxxxxxxxx xxx procedures xxx xxxxxxxxxxx xxxx are xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx operational site xxxxx be xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx xxxxxxx xx the xxxxxxxxx xxxx xxxxx be xxxxxxxxx from xxxx xx xxx xxxxxxx xxxx, in order xx xxxxx xxxx xxxx sites xxx xxxxxxxx xx xxx xxxx event xx xxx same xxxx. Xxx example, xxx xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid xxx xxxxxxx telecommunication xxxxxxx xxxx those xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx disruption rendering xxx primary site xxxxxxxxxxxx and/or xxxxxxxx xxxxx unavailable, xxx xxxxxxxx participant xxxxx xx able to xxxxxx xxxxxx operations xxxx the xxxxxxxxx xxxx, xxxxx xx xxxxx be xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx xxx xxx open xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx to xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx resumed from xxx xxxxxxxxx site xxxxxx a reasonable xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx xx service xxx commensurate to xxx criticality xx xxx xxxxxxxx that xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx xxxx xxxx operational xxxxxxxxxxx xxxxx be xxxxxx xx xxxxx xxxx x&xxxx;xxxx and critical xxxxx xxxxx xx xxxxxxxxxxxxx trained. The xxxxxxx xxxxxx xxxxxxx xxxxx shall not xxxxxx xxx year.