Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx xx xx. Xx establishing xxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (PoE), x.x. a system xxxxxxxx xx xxx xxxxxxxx xx transactions (e.g. xxxxxxxxxxxx, front-office xxx xxxx-xxxxxx xxxxxxxxxxxx, middleware), xxx xxxx xx xxx system responsible xx xxxx xxx xxxxxxx xx XXXXX (x.x. XXXXX XXX Xxx) or Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx to Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx policy

The xxxxxxxxxx xxxxx xxx x&xxxx;xxxxx xxxxxx direction xx xxxx xxxx xxxxxxxx xxxxxxxxxx xxx demonstrate xxxxxxx for xxx xxxxxxxxxx to information xxxxxxxx xxxxxxx xxx xxxxxxxx, approval xxx xxxxxxxxxxx of an xxxxxxxxxxx security xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx and xxxxx xxxxxxxxxx xxxxxx xxx xxxxxxxxxxxx in xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. Xxx xxxxxx xxxxxx contain xx xxxxx xxx xxxxxxxxx xxxxxxxx: objectives, xxxxx (xxxxxxxxx domains xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx management xxx.), principles xxx xxxxxxxxxx xx responsibilities.

Requirement 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx security xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx organisation. Xxx management shall xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx of xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to xxxxxx xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx organisation, xxxxxxxxx xxx allocation xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx this xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx security xx xxx organisation’s information xxx information xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx by xxx introduction xx, xxx/xx xxx xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx xx them. Xxx xxxxxx to xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx facilities xx xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx parties xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx xx xxxxxxx xxx xx determine xxx security xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx shall xx xxxxxx and defined xx an agreement xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx as xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx the xxxxx of the Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx accounted xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx xxx the xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx xxxxxxxxx xxx xxx related XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx assets xxxxx xx assigned. Xxxx: the xxxxx xxx xxxxxxxx the xxxxxxxxxxxxxx xx specific xxxxxxxx xx appropriate, xxx xxxxxxx xxxxxxxxxxx xxx the proper xxxxxxxxxx of the xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx classified xx xxxxx xx xxxxx xxxxxxxxxxx xx xxx smooth xxxxxxxx xx xxx service xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx shall xxxxxxxx xxx need, xxxxxxxxxx xxx xxxxxx xx protection xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxx xxxx take into xxxxxxxxxxxxx the xxxxxxxxxx XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx classification xxxxxx approved by xxx xxxxxxxxxx xxxxx xx xxxx to xxxxxx xx xxxxxxxxxxx xxx of xxxxxxxxxx xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx asset lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) and xx xxxxxxxxxxx the xxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx to employment xx xxxxxxxx xxx xxxxxxxxxxxx xxx in xxxxx and xxxxxxxxxx xx employment. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx and xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx screened, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, contractors xxx xxxxx party xxxxx of xxxxxxxxxxx xxxxxxxxxx facilities xxxxx xxxx xx agreement xx their xxxxxxxx xxxxx and xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx xxxxxxx among xxx xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, and education xxx xxxxxxxx in xxxxxxxx procedures and xxx xxxxxxx use xx information xxxxxxxxxx xxxxxxxxxx shall xx xxxxxxxx xx xxxx xx xxxxxxxx possible xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx process for xxxxxxxx security xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Responsibilities xxxxx xx xx xxxxx to ensure xxxx xx employee’s, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx xx transfer xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, xxx xxxx the xxxxxx xx all xxxxxxxxx xxx the xxxxxxx xx xxx xxxxxx xxxxxx are completed.

Requirement 1.7: Xxxxxxxx and xxxxxxxxxxxxx security

Critical xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx xx secure xxxxx, xxxxxxxxx by xxxxxxx xxxxxxxx perimeters, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx and xxxxxxxxxxxx. Xxxxxx xxxxx be xxxxxxx xxxx xx xxxxxxxxxxx who xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx standards xxxxx xx xxxxxxxxxxx xx protect xxxxxxxx xxxxx xxxxxxxxxx information xxxxxx when in xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx from xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx removal xx xxxxxxxx is xxxxxxxxx xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx xx information xxx to xxxxx xxxxxxx xxxx xx xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Special xxxxxxxx xxx xx xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx xx xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx end-to-end.

As regards xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx duties xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx xxxxxx xxx xxxx of xxxxxxxxx xx xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx duties xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx xxxxx be xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx analysis. Xxxxxxxx xxxxx xx established xx xxxxxxx xxx xxxxxx the xxxxxxxxxxxx xx xxxxxxxxx code xxx xxxxxxx in xxx Payment Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx xxxx established (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, xxxxxx xxx remove xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx xxxx xxxxxxx xxxxxxx (x.x. signed Xxxxxxxxx XXX components xxx Java Xxxxxxx). Xxx configuration xx xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx and xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx and xxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx policies xxxxx xxxxxxx x&xxxx;xxxx of xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular xxxxxxxxx xx least xxxxxxxx.

Xxxxxxx xxxx are xxxxxxxx xxx the xxxxxxxx xx xxxxxxxx xxxxx xx monitored xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx security shall xx xxxxxxxx. Xxxxxxxx xxxx shall xx xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx identified. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx reviewed xx x&xxxx;xxxxxx xxxxx, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx monitoring xxxxx xx used xx xxxxx the xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxxxx xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx and xx xxxxxx xxxxxxxxxx xx xx access policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations xxxxx xx xxxxx on x&xxxx;xxxxxx exchange policy, xxxxxxx out xx xxxx xxxx exchange xxxxxxxxxx xxxxx xxx xxxxxxxx parties and xxxxx xx xxxxxxxxx xxxx any relevant xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx components xxxxxxxx xx xxx xxxxxxxx xx information xxxx XXXXXX2 (like xxxxxxxx xxxxxxxx from a Service Xxxxxx xx xxxxxxxx 2 of xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx with xxx third party.

Requirement 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxxx xx xxx xxxxx xx business requirements (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx the established xxxxxxxxx of xxxxxxxxx xxxxxxxx (including the xxxxxxxxxxx security policy). Xxxxx xxxxxx xxxxxxx xxxxx shall xx xxxxxxx xxxxx xx xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx xxx xxxxx of xxx xxxxxxxxxxxxx business xxx XX xxxxxxxxx. Where xxxxxxxx (e.g. xxx xxxxxx management) logical xxxxxx control xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx xxx xxxxxxxx xxxxxxxxxxxx controls xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx and xxxxxxxxxx xxxxxxxxxx shall be xx xxxxx to xxxxxxx the xxxxxxxxxx xx access xxxxxx xx information xxxxxxx xxx services that xxxx within xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxx xxxxxxxxxx shall xxxxx xxx xxxxxx xx the xxxxxxxxx xx xxxx xxxxxx, xxxx the xxxxxxx xxxxxxxxxxxx xx xxx xxxxx xx the xxxxx deregistration of xxxxx xxxx xx xxxxxx xxxxxxx access.

Special xxxxxxxxx shall xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx xxxxxxxxxx xx access rights xx xxxx criticality xxxx xxx abuse xx xxxxx access xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx adverse xxxxxx xx xxx xxxxxxxxxx of xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, xxxxxx xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx xx identify, xxxxxxxxxxxx xxx authorise xxxxx xx specific xxxxxx in the xxxxxxxxxxxx’x xxxxxxx, e.g. xxx xxxxx xxx xxxxxx xxxxxx to xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx passwords, xxxxx shall xx xxxxxxxxxxx and xxxxxxxx xx xxxxxxxx xxxxxxxx xx ensure xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx rules xxx xxxxxxx-xxxx xxxxxxxx. A safe xxxxxxxx xxxxxxxx and/or xxxxx protocol xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. A key management xxxxxx shall xx xxxxxxxxxxx to xxxxxxx xxx xxx of xxxxxxxxxxxxx controls.

There shall xx xxxxxx for xxxxxxx xxxxxxxxxxxx information xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, a clear xxxx xxxxxx) to xxxxxx the xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, the xxxxx xx xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx xx identified xxx xxxxxx xxxxx xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be built xxxx applications, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx correct processing. Xxxxx controls shall xxxxxxx xxx validation xx xxxxx xxxx, xxxxxxxx xxxxxxxxxx and xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, or xxxx xx xxxxxx xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx controls xxxxx xx xxxxxxxxxx on xxx basis xx xxxxxxxx requirements xxx xxxx assessment according xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx shall xx xxxxxxxxxxx, documented and xxxxxx xxxxx to xxxxx xxxxxxxxxx xxx xxx. Xx xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx on xxx xxxxxxxxxxx xx xxxx xxxxx xxx xxx xxxxx of risk xx xxx xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx specific xxxxxxxx xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx files and xxxxxxx xxxxxx code xxxxx be xxxxxxxxxx xxx XX projects xxx support xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx taken xx xxxxx xxxxxxxx of xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Project xxx xxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx xxx major xxxxxxx xx xx xxxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx shall also xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx the xxxxxxx xx a risk xxxxxxxxxx, xxx xxxxxxxx xxxxxxx shall include, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. All xx xxx xxxxxxxxxxxx highlighted xxxxxx the xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xxx xxxxxx xxxxx to xxxxx xxx identified xxx xxxxx xx xxxxxxxx and followed xx in x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx in xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx protection xx xxx xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx xxx accessible xx suppliers, xxxxxxxxxxx xxxxxxxx requirements for xxxxxxxxxx xxx risks xxxxxxxxxx xxxx supplier’s xxxxxx shall be xxxxxxxxxx xxx formally xxxxxx upon xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx incidents and xxxxxxxxxxxx

Xx xxxxxx a consistent xxx xxxxxxxxx approach xx xxx xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx events xxx weaknesses, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx level, xxxxx xx xxxxxxxxxxx xxx xxxxxx to xxxxxx x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx xxx safely xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx incidents xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (e.g. x&xxxx;xxxxx pursued xx xx external xxxxxxxx xx by xx xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx procedures xxxxx be xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (x.x. xxxx office systems, xxxxxxxx xxxxxxxx xxx xxxxxxxx network xxxxxxxxxxxx) xxxxx be regularly xxxxxxxx for xxxxxxxxxx xxxx the organisation’s xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx comply with xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx systems (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx system, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. production xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx xxxxxxxx xx xxxxxx xxxxxx, xx xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, xxxxx xx implemented xxxxx xx a risk assessment. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx xxxxxxxxxx xxxxx xxxx a similar xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx xx xxxxxx and/or hybrid xxxxx xxxxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx must be xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx xxxxxxx the xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx to xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions are xxxx, xx xx xxxxxxxxxx that xxx xxxxxxxxxxx level of xxx xxxxxxx system xx xxx xxxxxxx xxx of the xxxxxxxxx systems. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx participants)

The xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx continuity xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx as xxxxx xxxxxxxx xxx xxx xxxxxx xxxxxxxxxxx xx the TARGET2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx following elements.

Requirement 2.1	:	Xxxxxxxx continuity xxxxx xxxxx xx xxxxxxxxx xxx procedures xxx xxxxxxxxxxx xxxx xxx xx place.
Requirement 2.2	:	An xxxxxxxxx xxxxxxxxxxx xxxx xxxxx xx available.
Requirement 2.3	:	Xxx risk xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx be xxxxxxxxx from xxxx xx xxx primary xxxx, in order xx avoid that xxxx xxxxx xxx xxxxxxxx xx xxx xxxx event xx xxx same xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx xxxx xxx xxxxxxx telecommunication circuit xxxx xxxxx of xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx the xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx site xxxxxxxxxxxx and/or xxxxxxxx xxxxx unavailable, xxx xxxxxxxx participant xxxxx xx xxxx xx xxxxxx xxxxxx operations xxxx xxx alternate xxxx, where xx xxxxx xx xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx xxx xxx open xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx that xxx xxxxxxxxxx xx transactions xx xxxxxxx from xxx alternate xxxx xxxxxx a reasonable timeframe xxxxx xxx initial xxxxxxxxxx of service xxx commensurate xx xxx xxxxxxxxxxx xx xxx xxxxxxxx xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx xxxxxxx xxxxx shall not xxxxxx xxx year.