Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxx continuity xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx each participant, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx to it. Xx establishing xxx xxxxx of xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx xxx xxxx xx the Xxxxxxx Xxxxxxxxxxx Chain (XXX). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. a system xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx xx xxx system xxxxxxxxxxx xx xxxx xxx xxxxxxx xx XXXXX (x.x. XXXXX XXX Xxx) xx Internet (xxxx xxx latter xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx policy

The xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx with business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx to information xxxxxxxx xxxxxxx the xxxxxxxx, approval xxx xxxxxxxxxxx xx xx xxxxxxxxxxx security xxxxxx xxxxxx xx managing xxxxxxxxxxx security xxx xxxxx resilience xxxxxx xxx xxxxxxxxxxxx in xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx treatment xx xxxxxxxxxxx xxxxxxxx xxx cyber xxxxxxxxxx xxxxx. The xxxxxx xxxxxx contain xx xxxxx the xxxxxxxxx xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx organisation, xxxxx xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx and xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx xxxxxxxx framework xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx organisation. Xxx management shall xxxxxxxxxx and xxxxxx xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to xxxxxx xxx implementation xx xxx xxxxxxxxxxx security xxxxxx (xx per Xxxxxxxxxxx 1.1) xxxxxx xxx organisation, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx xxxxxxxxx and xxxxxxxxxx xx security xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx of xxx organisation’s xxxxxxxxxxx xxx information xxxxxxxxxx xxxxxxxxxx xxxxxx not xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx xxx xxxxxxxxxx xx, xx external xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx access xx xxx organisation’s information xxxxxxxxxx xxxxxxxxxx by xxxxxxxx parties xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx of external xxxxxxx are xxxxxxxx xx access xxx xxxxxxxxxxxx’x information processing xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx xx xxxxxxx xxx to determine xxx security implications xxx xxxxxxx requirements. Xxxxxxxx shall xx xxxxxx and xxxxxxx xx xx xxxxxxxxx xxxx each xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, the xxxxxxxx xxxxxxxxx and xxx xxxxxxxxxx information xxxxxxx, xxxx as xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx xxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx processes xxx xxx related XX xxxxxxxxxx to safeguard xxx information xxxxxx xxxxx xx xxxxxxxx. Xxxx: the xxxxx xxx xxxxxxxx the xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx as xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx xxx proper xxxxxxxxxx xx the xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx classified xx terms xx xxxxx xxxxxxxxxxx xx xxx smooth delivery xx the service xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx degree xx xxxxxxxxxx xxxxxxxx xxxx handling xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX components. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx by xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx an xxxxxxxxxxx xxx of protection xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx removal xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx to xxxxxxxxxxx xxx need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx employment xx xxxxxxxx xxx xxxxxxxxxxxx xxx xx xxxxx and xxxxxxxxxx xx xxxxxxxxxx. All xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx and third xxxxx xxxxx xxxxx xx adequately screened, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, contractors xxx xxxxx xxxxx xxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx agreement xx xxxxx security xxxxx and responsibilities. Xx adequate xxxxx xx xxxxxxxxx shall xx ensured xxxxx xxx xxxxxxxxx, xxxxxxxxxxx xxx third party xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx procedures and xxx xxxxxxx use xx xxxxxxxxxxx processing xxxxxxxxxx xxxxx xx xxxxxxxx xx them xx xxxxxxxx possible xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx process for xxxxxxxx security xxxxxxxx xxxxx xx xxxxxxxxxxx xxx employees. Xxxxxxxxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x or third xxxxx user’s exit xxxx or xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, and xxxx xxx return xx xxx xxxxxxxxx xxx the removal xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx information processing xxxxxxxxxx xxxxx xx xxxxxx xx secure xxxxx, protected xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx shall xx physically xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx shall xx xxxxxxx xxxx to xxxxxxxxxxx xxx fall xxxxxx xxx scope xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx and standards xxxxx xx established xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx information xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx shall be xxxxxxxxx xxxx xxxxxxxx xxx environmental xxxxxxx. Xxxxxxxxxx of xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) and xxxxxxx xxx xxxxxxx xx xxxxxxxx is xxxxxxxxx xx xxxxxx the xxxx xx xxxxxxxxxxxx xxxxxx xx xxxxxxxxxxx xxx to guard xxxxxxx xxxx or xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx xxx electrical xxxxxx xxx cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx be xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Transaction Xxxxx end-to-end.

As xxxxxxx xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx duties xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx xxxxxx xxx xxxx of xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Where xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx documented xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx established xx xxxxxxx and xxxxxx xxx introduction xx malicious xxxx xxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx shall xx also xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, xxxxxx xxx remove xxxxxxxxx xxxx. Xxxxxx code xxxxx xx xxxx xxxx from trusted xxxxxxx (x.x. xxxxxx Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx xxx xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx xx xxx restoration xxxxxxx xxxxx xx xxxxxx xx xxxxxxx xxxxxxxxx xx least xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx xxx security xx payments xxxxx xx xxxxxxxxx and xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxx. Xxxxxxxx xxxx xxxxx be xxxx xx xxxxxx xxxx information xxxxxx xxxxxxxx are identified. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx reviewed xx x&xxxx;xxxxxx xxxxx, xxxxx on xxx xxxxxxxxxxx of xxx xxxxxxxxxx. Xxxxxx monitoring xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxxxx xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx and xx xxxxxx xxxxxxxxxx xx xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx shall xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx policy, xxxxxxx out xx xxxx with exchange xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx employed xx xxx xxxxxxxx xx xxxxxxxxxxx with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 xx xxx xxxxx xxxxxxx xx xxx TARGET2 self-certification xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx agreement xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx information assets xxxxx xx xxxxxxxxx xx xxx basis xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx the xxxxxxxxxxx xxxxxxxxx of corporate xxxxxxxx (including the xxxxxxxxxxx security xxxxxx). Xxxxx access xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx xx xxx xxxxxxxxx of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely the xxxxx xx the xxxxxxxxxxxxx xxxxxxxx and XX xxxxxxxxx. Xxxxx xxxxxxxx (x.x. xxx xxxxxx management) xxxxxxx xxxxxx xxxxxxx xxxxxx xx consistent with xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx xxx xxxxxxxx compensatory xxxxxxxx xx place (e.g. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xx place xx xxxxxxx xxx allocation xx xxxxxx xxxxxx xx information xxxxxxx xxx services xxxx xxxx xxxxxx xxx xxxxx xx the Xxxxxxx Transaction Chain. Xxx xxxxxxxxxx xxxxx xxxxx all xxxxxx xx the xxxxxxxxx xx user access, xxxx xxx xxxxxxx xxxxxxxxxxxx of xxx xxxxx to the xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx xx xxxxxx xxxxxxx xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx be xxxxx, xxxxx appropriate, xx the allocation xx xxxxxx xxxxxx xx xxxx criticality xxxx the abuse xx xxxxx xxxxxx xxxxxx xxxxx lead xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx the xxxxxxxxxx xx xxx xxxxxxxxxxx (e.g. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx of xxxxxx controls, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx shall xx xxx xx xxxxx xx identify, xxxxxxxxxxxx and xxxxxxxxx xxxxx at xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, e.g. xxx local and xxxxxx access xx xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx shall xxx be shared xx xxxxx to xxxxxx accountability.

For xxxxxxxxx, xxxxx shall xx xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx ensure xxxx xxxxxxxxx cannot xx xxxxxx guessed, x.x. xxxxxxxxxx xxxxx and xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx recovery and/or xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx and xxxxxxxxxxx on the xxx xx xxxxxxxxxxxxx xxxxxxxx xx xxxxxxx xxx confidentiality, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. A key xxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxxx xx support xxx xxx of xxxxxxxxxxxxx controls.

There xxxxx xx policy for xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, a clear xxxx policy) xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx remotely, the xxxxx xx xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx be xxxxxxxxxx xxx appropriate xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall be xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxx prior xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx built xxxx applications, including xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx processing. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx validation xx input xxxx, xxxxxxxx processing xxx xxxxxx xxxx. Additional xxxxxxxx may be xxxxxxxx for xxxxxxx xxxx process, xx xxxx xx xxxxxx xx, xxxxxxxxx, xxxxxxxx xx critical xxxxxxxxxxx. Xxxx controls shall xx xxxxxxxxxx on xxx basis of xxxxxxxx xxxxxxxxxxxx and xxxx xxxxxxxxxx according xx xxx xxxxxxxxxxx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx new xxxxxxx xxxxx be xxxxxxxxxxx, documented xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx xxx xxx. Xx xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx be xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx xxx xxx xxxxx xx xxxx xx xxx network xxxxx xx xxx xxxxxxxxxxxx. There xxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxx sensitive xxxxxxxxxxx passing over xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx and xxxxxxx xxxxxx xxxx xxxxx xx controlled xxx IT xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Xxxx shall xx taken xx xxxxx xxxxxxxx xx xxxxxxxxx data xx xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx in production xxxxx xx xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx the xxxxx xxxxxxx to xx xxxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx testing activities xx xxxxxxx in xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx plan xxxxx xx the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx shall xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx of xxx xxxxxxxxxxxx highlighted xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx shall xx xxxxxxxx xxx xxxxxx plans to xxxxx xxx identified xxx shall xx xxxxxxxx and xxxxxxxx xx in a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx xxxxxx protection xx xxx xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx are xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx the xxxxx xxxxxxxxxx with supplier’s xxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx ensure x&xxxx;xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx xx the management xx information security xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx xxxxx, xxxxx xx established xxx xxxxxx to xxxxxx x&xxxx;xxxxx, effective xxx xxxxxxx and xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx including xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx xxxxx (e.g. x&xxxx;xxxxx pursued xx xx xxxxxxxx xxxxxxxx xx by xx xxxxxxx). Personnel xxxxxxxx xx xxxxx procedures xxxxx xx adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx and xxxxxxxx network xxxxxxxxxxxx) xxxxx xx regularly xxxxxxxx xxx compliance xxxx xxx organisation’s xxxxxxxxxxx framework xx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx xxxxxx xxxx xxx xxx xxxxxxxx xxxxxxxx that xxx xxx xxx physical xxxxxxxx xxx systems (x.x. xxxxxxxxx, logging). Xxxxxxxx relating xx xxxxxxxxxxx xxxx include: xxxxxxxxx of the xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx patching, strict xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. production xxx development). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx xxxxxxxx xx xxxxxx rights, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx accounts, shall xx implemented based xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx virtual xxxxxxxx xxxxxxx xx the xxxx hypervisor xxxxx xxxx a similar xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx hybrid xxxxx solutions xx xxx Payment Xxxxxxxxxxx Xxxxx must xx xxxxx on x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx contractual xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx are xxxx, it is xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx overall xxxxxx xx the highest xxx of the xxxxxxxxx systems. All xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx xx segregated xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx by xxx Xxxxxxxxxx xx xxxxx xxxxxxxx for xxx xxxxxx xxxxxxxxxxx xx xxx TARGET2 xxxxxx xxxxx have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx place xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx continuity xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx for xxxxxxxxxxx them are xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx xx available.
Requirement 2.3	:	Xxx xxxx xxxxxxx xx the xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx the xxxxxxx xxxx, xx order xx avoid that xxxx sites are xxxxxxxx xx the xxxx xxxxx xx xxx same xxxx. Xxx example, xxx xxxxxxxxx site shall xx xx x&xxxx;xxxxxxxxx xxxxx xxxx xxx xxxxxxx telecommunication xxxxxxx xxxx xxxxx xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx the xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx site xxxxxxxxxxxx and/or critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx able xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx it xxxxx be xxxxxxxx xx properly xxxxx xxx xxxxxxxx xxx xxx xxxx xxx xxxxxxxxx xxxxxxxx day(s).
Requirement 2.5	:	Xxxxxxxxxx xxxxx xx xx place xx xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx xxx xxxxxxx xxxxxxxxxx xx xxxxxxx xxx commensurate to xxx xxxxxxxxxxx xx xxx business xxxx xxx disrupted.
Requirement 2.6	:	The xxxxxxx xx xxxx xxxx xxxxxxxxxxx disruptions xxxxx be xxxxxx xx xxxxx xxxx x&xxxx;xxxx and xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. The xxxxxxx xxxxxx xxxxxxx xxxxx shall xxx xxxxxx xxx xxxx.