Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx xxxxxxxx management xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx are xxxxxxxxxx xx each xxxxxxxxxxx, xxxxxx xxx participant xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx xx xx. Xx xxxxxxxxxxxx the xxxxx xx application xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx involved xx xxx creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, front-office xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx responsible xx xxxx xxx xxxxxxx xx SWIFT (x.x. SWIFT XXX Xxx) xx Xxxxxxxx (xxxx xxx latter xxxxxxxxxx to Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx management xxxxx xxx x&xxxx;xxxxx xxxxxx direction in xxxx xxxx business xxxxxxxxxx xxx demonstrate xxxxxxx xxx and xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx through xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx of an xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xx managing xxxxxxxxxxx security and xxxxx resilience across xxx xxxxxxxxxxxx xx xxxxx of identification, xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. Xxx xxxxxx xxxxxx contain xx xxxxx xxx following xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, asset xxxxxxxxxx xxx.), xxxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx implement xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx xxxxxxxxxxxx. Xxx xxxxxxxxxx shall xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx xxxxxxxxxxxxxx xx xxx information security xxxxxx (as xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, including xxx allocation xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx security xxxxxxxxxxxxxxxx xxx this xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx xx xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx should xxx xx xxxxxxx by xxx introduction xx, xxx/xx xxx xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx xx xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x information xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx xxxxxxx shall xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx external xxxxxxx xxx required xx xxxxxx xxx xxxxxxxxxxxx’x information xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be carried xxx xx xxxxxxxxx xxx xxxxxxxx xxxxxxxxxxxx xxx control requirements. Xxxxxxxx xxxxx xx xxxxxx xxx defined xx xx agreement xxxx xxxx xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx and the xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, off-the-shelf products, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, xx the xxxxx xx the Xxxxxxx Transaction Chain xxxxx xx accounted xxx xxx have x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx for xxx xxxxxxxxxxx xxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx the xxxxxxxx xxxxxxxxx xxx xxx related XX xxxxxxxxxx to safeguard xxx xxxxxxxxxxx xxxxxx xxxxx xx assigned. Xxxx: the xxxxx xxx delegate xxx xxxxxxxxxxxxxx of specific xxxxxxxx xx appropriate, xxx xxxxxxx xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx classification

Information xxxxxx xxxxx be xxxxxxxxxx xx xxxxx xx xxxxx xxxxxxxxxxx xx xxx smooth delivery xx xxx xxxxxxx xx xxx participant. Xxx xxxxxxxxxxxxxx shall xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx protection xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx and xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx the underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx xx protection xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx asset xxxxxxxxx (xxxxxxxxx xxxxxxx and xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx xxx need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx security

Security responsibilities xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx and xx xxxxx xxx conditions xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx and xxxxx xxxxx users shall xx xxxxxxxxxx screened, xxxxxxxxxx for xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx party xxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xxxx xx xxxxxxxxx xx their security xxxxx xxx responsibilities. Xx adequate xxxxx xx awareness xxxxx xx ensured xxxxx xxx employees, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, xxx education xxx xxxxxxxx xx xxxxxxxx procedures xxx xxx correct xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security xxxxxxxx xxxxx xx xxxxxxxxxxx xxx employees. Responsibilities xxxxx be xx xxxxx to ensure xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx third xxxxx xxxx’x xxxx xxxx xx xxxxxxxx xxxxxx xxx organisation xx managed, xxx xxxx xxx xxxxxx xx all equipment xxx xxx removal xx xxx xxxxxx xxxxxx xxx completed.

Requirement 1.7: Xxxxxxxx and xxxxxxxxxxxxx security

Critical xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx in xxxxxx xxxxx, protected xx xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. They xxxxx xx physically xxxxxxxxx xxxx unauthorised xxxxxx, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx protect xxxxxxxx xxxxx containing xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx physical xxx environmental threats. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx of xxxxxxxx is necessary xx reduce xxx xxxx xx xxxxxxxxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxx xxxxxxx loss or xxxxxx xx xxxxxxxxx xx information. Xxxxxxx xxxxxxxx xxx be xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx xx xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx xxx electrical xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxx xxxxxxxxxx xxx operation of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx of XX systems, xxxxxxxxxxx xx duties xxxxx xx implemented, xxxxx xxxxxxxxxxx, to xxxxxx xxx xxxx xx xxxxxxxxx or xxxxxxxxxx xxxxxx misuse. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx shall be xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx established xx xxxxxxx xxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx code xxx systems xx xxx Payment Transaction Xxxxx. Xxxxxxxx shall xx xxxx established (xxxxxxxxx xxxx awareness) xx prevent, detect xxx remove xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx be xxxx xxxx from xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx browser (x.x. xxx use of xxxxxxxxxx xxx xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx policies shall xxxxxxx x&xxxx;xxxx of xxx xxxxxxxxxxx xxxxxxx xxxxx is xxxxxx xx xxxxxxx intervals xx xxxxx xxxxxxxx.

Xxxxxxx xxxx are critical xxx xxx xxxxxxxx xx payments xxxxx xx xxxxxxxxx xxx xxxxxx xxxxxxxx to xxxxxxxxxxx security xxxxx xx recorded. Xxxxxxxx xxxx xxxxx be xxxx xx xxxxxx xxxx xxxxxxxxxxx system xxxxxxxx are xxxxxxxxxx. Xxxxxxxx xxxx shall xx regularly xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on xxx xxxxxxxxxxx xx the xxxxxxxxxx. System monitoring xxxxx be used xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx are xxxxxxxxxx xx critical xxx xxx security xx xxxxxxxx xxx to xxxxxx conformity to xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations xxxxx xx based xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out xx xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx parties xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Third xxxxx xxxxxxxx components xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 xx the xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx with xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx xxxxxx xxxxx xx justified xx the xxxxx xx xxxxxxxx requirements (xxxx-xx-xxxx&xxxx;(1)) and according xx the xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including the xxxxxxxxxxx xxxxxxxx policy). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx on xxx principle of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely the xxxxx xx the xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Where xxxxxxxx (e.g. xxx xxxxxx xxxxxxxxxx) logical xxxxxx control xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx access xxxxxxx xxxxxx there are xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal data xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx shall xx xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx access xxxxxx xx information xxxxxxx xxx services xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx procedures xxxxx xxxxx xxx xxxxxx xx xxx lifecycle xx xxxx xxxxxx, xxxx xxx initial xxxxxxxxxxxx of new xxxxx to xxx xxxxx xxxxxxxxxxxxxx xx xxxxx that xx xxxxxx xxxxxxx xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx allocation xx xxxxxx rights xx such xxxxxxxxxxx xxxx the xxxxx xx xxxxx xxxxxx xxxxxx could xxxx xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx of xxx xxxxxxxxxxx (e.g. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx controls, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx to identify, xxxxxxxxxxxx xxx authorise xxxxx xx specific xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, e.g. xxx xxxxx xxx xxxxxx access to xxxxxxx in the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx xx shared xx order xx xxxxxx accountability.

For xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx and enforced xx xxxxxxxx controls xx ensure xxxx xxxxxxxxx xxxxxx xx xxxxxx guessed, x.x. xxxxxxxxxx xxxxx and xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx developed and xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx to xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx. A key xxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx use of xxxxxxxxxxxxx controls.

There shall xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx print (e.g. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx policy) to xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx remotely, xxx xxxxx of xxxxxxx xx xx unprotected xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx appropriate xxxxxxxxx and organisational xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxx prior xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx of xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be built xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx applications, xx xxxxxx xxxxxxx processing. Xxxxx controls xxxxx xxxxxxx the xxxxxxxxxx xx input data, xxxxxxxx processing and xxxxxx data. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, xx xxxx xx xxxxxx xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx on xxx xxxxx of xxxxxxxx xxxxxxxxxxxx and xxxx assessment according xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx prior xx xxxxx xxxxxxxxxx xxx xxx. Xx regards xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx be xxxxxxxxxxx xxxxx on xxx xxxxxxxxxxx of data xxxxx and the xxxxx of xxxx xx the network xxxxx xx the xxxxxxxxxxxx. Xxxxx xxxxx xx specific xxxxxxxx xx xxxxxxx sensitive xxxxxxxxxxx passing over xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx xxx xxxxxxx source code xxxxx be controlled xxx XX projects xxx xxxxxxx xxxxxxxxxx xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx xxxxx to xxxxx xxxxxxxx xx xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx in production xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx xxx xxxxx xxxxxxx xx be xxxxxxxx xx production xxxxx be xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx activities xx xxxxxxx in xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx on the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, and security xxxxxxx shall xxxxxxx, xx least, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx and xxxxxx plans to xxxxx xxx xxxxxxxxxx xxx xxxxx xx xxxxxxxx and followed xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx are xxxxxxxxxx xx xxxxxxxxx, information xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx with xxxxxxxx’x xxxxxx xxxxx be xxxxxxxxxx xxx xxxxxxxx xxxxxx upon xxxx xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx effective approach xx xxx xxxxxxxxxx xx xxxxxxxxxxx security xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx business xxx xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx and xxxxxx to ensure x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx xxx xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (e.g. x&xxxx;xxxxx xxxxxxx by xx xxxxxxxx attacker xx by xx xxxxxxx). Personnel xxxxxxxx xx xxxxx procedures xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx (e.g. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx network connectivity) xxxxx be regularly xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx framework xx xxxxxxxx (e.g. information xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual machines xxxxx comply xxxx xxx the xxxxxxxx xxxxxxxx xxxx are xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx include: xxxxxxxxx xx xxx xxxxxxxxxx xxx the xxxxxxx xxxxxxxxx system, xxxxxxx patching, xxxxxx xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx development). Xxxxxxxxxxx xxxxxxxxxx, logging and xxxxxxxxxx xx well xx xxxxxxxx xx xxxxxx rights, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, shall xx xxxxxxxxxxx xxxxx xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx xx xxx xxxx xxxxxxxxxx xxxxx xxxx x&xxxx;xxxxxxx risk xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx usage of xxxxxx xxx/xx hybrid xxxxx xxxxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx must xx xxxxx xx x&xxxx;xxxxxx xxxx assessment, xxxxxx xxxx account xxx xxxxxxxxx xxxxxxxx xxx xxx contractual xxxxxxx xxxxxxx to xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions are xxxx, xx xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx level of xxx xxxxxxx system xx the xxxxxxx xxx xx the xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx be xxxxxxxxxx xxxx xxx other xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx business xxxxxxxxxx xxxxxxxxxx. Each TARGET2 xxxxxxxxxxx xxxxxxxxxx by xxx Xxxxxxxxxx as xxxxx xxxxxxxx xxx xxx xxxxxx xxxxxxxxxxx xx xxx TARGET2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx strategy xx xxxxx comprising xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx procedures xxx xxxxxxxxxxx xxxx xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx xxxxxxx xx the xxxxxxxxx xxxx xxxxx be xxxxxxxxx from xxxx xx xxx primary xxxx, xx order xx avoid xxxx xxxx xxxxx xxx xxxxxxxx xx xxx xxxx event xx xxx same time. Xxx xxxxxxx, xxx xxxxxxxxx site xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid and xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those of xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In the xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx site xxxxxxxxxxxx and/or critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx alternate xxxx, where xx xxxxx xx xxxxxxxx xx properly xxxxx xxx xxxxxxxx xxx xxx xxxx xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx xx transactions xx resumed xxxx xxx xxxxxxxxx xxxx xxxxxx a reasonable xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx of service xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx business that xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx xxxx xxxx operational xxxxxxxxxxx xxxxx be xxxxxx xx xxxxx once x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx trained. The xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx not xxxxxx xxx xxxx.