Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx xxxx participant, xxxxxx xxx participant xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx xx not xxxxxxxxxx to it. Xx xxxxxxxxxxxx the xxxxx xx xxxxxxxxxxx xx the xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx the xxxxxxxx xxxx xxx part xx the Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx a Point xx Xxxxx (PoE), x.x. x&xxxx;xxxxxx involved xx the xxxxxxxx xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx ends xx xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx xx XXXXX (x.x. XXXXX VPN Xxx) or Xxxxxxxx (xxxx xxx latter xxxxxxxxxx to Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx xxxx business xxxxxxxxxx and demonstrate xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx the xxxxxxxx, xxxxxxxx and xxxxxxxxxxx of xx xxxxxxxxxxx security xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx across xxx xxxxxxxxxxxx xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx information security xxx cyber xxxxxxxxxx xxxxx. The policy xxxxxx xxxxxxx at xxxxx xxx xxxxxxxxx xxxxxxxx: objectives, xxxxx (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), principles xxx xxxxxxxxxx of xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx xxxxxxxxxxxx. Xxx management shall xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to xxxxxx xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx resources xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx of xxx organisation’s information xxx information processing xxxxxxxxxx xxxxxx not xx reduced xx xxx introduction xx, xxx/xx xxx xxxxxxxxxx xx, xx external xxxxx/xxxxxxx or xxxxxxxx/xxxxxxxx xxxxxxxx by xxxx. Xxx xxxxxx to xxx organisation’s information xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties xxxxx xx controlled. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx are required xx xxxxxx the xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx xx determine xxx xxxxxxxx xxxxxxxxxxxx xxx control xxxxxxxxxxxx. Xxxxxxxx shall be xxxxxx xxx defined xx an agreement xxxx xxxx xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx management

All information xxxxxx, xxx business xxxxxxxxx and xxx xxxxxxxxxx information systems, xxxx xx xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, xx the xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx accounted xxx and have x&xxxx;xxxxxxxxx owner. The xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx xxx the xxxxxxxxx of xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx be assigned. Xxxx: xxx xxxxx xxx delegate the xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx remains xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxx xx terms xx xxxxx xxxxxxxxxxx xx xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx xxx xxxxxxxxxxx. Xxx classification xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx degree xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx business xxxxxxxxx xxx xxxxx xxxx take into xxxxxxxxxxxxx the underlying XX components. An xxxxxxxxxxx xxxxx classification xxxxxx approved xx xxx xxxxxxxxxx shall xx xxxx xx xxxxxx xx appropriate xxx xx xxxxxxxxxx xxxxxxxx throughout xxx xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx information xxxxxx) xxx xx xxxxxxxxxxx xxx xxxx xxx specific handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx security

Security responsibilities xxxxx xx addressed xxxxx xx employment xx adequate xxx xxxxxxxxxxxx xxx in xxxxx xxx conditions xx employment. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xx their xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx adequate level xx xxxxxxxxx shall xx xxxxxxx xxxxx xxx xxxxxxxxx, contractors xxx xxxxx xxxxx xxxxx, xxx xxxxxxxxx xxx training in xxxxxxxx procedures and xxx xxxxxxx use xx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx to xxxx xx minimise xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx process xxx xxxxxxxx security xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx to xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx or xxxxxxxx xxxxxx xxx organisation xx managed, and xxxx the return xx all xxxxxxxxx xxx the removal xx xxx access xxxxxx xxx completed.

Requirement 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx security

Critical xx xxxxxxxxx information xxxxxxxxxx xxxxxxxxxx shall be xxxxxx in xxxxxx xxxxx, protected xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx and entry xxxxxxxx. They xxxxx xx xxxxxxxxxx protected xxxx xxxxxxxxxxxx xxxxxx, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx be xxxxxxx only to xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx physical xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx physical xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of equipment (xxxxxxxxx xxxxxxxxx used xxx-xxxx) and against xxx xxxxxxx xx xxxxxxxx xx necessary xx xxxxxx the xxxx xx xxxxxxxxxxxx xxxxxx xx information xxx to guard xxxxxxx loss or xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx xxx be xxxxxxxx to protect xxxxxxx xxxxxxxx xxxxxxx xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx systems in xxx Payment Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx procedures, including xxxxxxxxx xxxxxxxxxxxxxx of XX xxxxxxx, xxxxxxxxxxx xx xxxxxx shall xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx xxxxxx xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx of xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx documented xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx following a formal xxxx xxxxxxxx. Xxxxxxxx xxxxx be xxxxxxxxxxx xx prevent xxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx xxxx established (xxxxxxxxx user awareness) xx prevent, detect xxx xxxxxx xxxxxxxxx xxxx. Mobile xxxx xxxxx xx xxxx xxxx xxxx xxxxxxx xxxxxxx (e.g. signed Xxxxxxxxx COM components xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (x.x. xxx use xx xxxxxxxxxx xxx xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx and xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx a plan of xxx xxxxxxxxxxx xxxxxxx xxxxx is xxxxxx xx xxxxxxx xxxxxxxxx xx least xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx xxx security xx xxxxxxxx xxxxx xx xxxxxxxxx and xxxxxx xxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxx xx recorded. Xxxxxxxx xxxx xxxxx xx xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx are identified. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx reviewed xx a sample xxxxx, xxxxx xx the xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxxxx xx critical for xxx xxxxxxxx of xxxxxxxx and to xxxxxx xxxxxxxxxx xx xx access policy xxxxx.

Xxxxxxxxx xx information xxxxxxx xxxxxxxxxxxxx xxxxx xx xxxxx on x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out xx xxxx xxxx xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx compliant xxxx any xxxxxxxx xxxxxxxxxxx. Third party xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx information with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 xx xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) must xx used xxxxx x&xxxx;xxxxxx agreement with xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Access xxxxxxx

Xxxxxx xx xxxxxxxxxxx assets xxxxx xx justified xx the xxxxx xx business xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) and xxxxxxxxx xx xxx established xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx be xxxxxxx xxxxx xx xxx principle xx xxxxx privilege (2) to xxxxxxx closely the xxxxx xx the xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) logical xxxxxx xxxxxxx xxxxxx xx consistent xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx are xxxxxxxx compensatory controls xx place (x.x. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx and xxxxxxxxxx xxxxxxxxxx xxxxx be xx place xx xxxxxxx xxx xxxxxxxxxx xx access rights xx xxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxx xxxx xxxxxx xxx xxxxx of the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx procedures xxxxx xxxxx all xxxxxx xx xxx xxxxxxxxx xx xxxx access, xxxx xxx initial xxxxxxxxxxxx of xxx xxxxx to the xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx no xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx be xxxxx, where appropriate, xx xxx allocation xx access xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx xxxxx xx xxxxx xxxxxx xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx adverse xxxxxx on xxx xxxxxxxxxx xx the xxxxxxxxxxx (e.g. xxxxxx xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx put in xxxxx xx xxxxxxxx, xxxxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, e.g. xxx xxxxx xxx xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx accounts xxxxx xxx be xxxxxx xx order xx xxxxxx xxxxxxxxxxxxxx.

Xxx passwords, xxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxx xx specific controls xx ensure xxxx xxxxxxxxx cannot xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. A safe xxxxxxxx xxxxxxxx and/or xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx developed xxx xxxxxxxxxxx xx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx to protect xxx xxxxxxxxxxxxxxx, authenticity xxx integrity xx xxxxxxxxxxx. A key xxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxxx to xxxxxxx xxx use xx xxxxxxxxxxxxx controls.

There xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx information xx screen xx xx print (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) to xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx remotely, the xxxxx xx working xx xx xxxxxxxxxxx xxxxxxxxxxx shall xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx and xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxx prior xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxx xxxx xxxxxxxxxxxx, including xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx correct xxxxxxxxxx. Xxxxx xxxxxxxx xxxxx xxxxxxx the xxxxxxxxxx xx xxxxx xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx data. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx for xxxxxxx xxxx xxxxxxx, or xxxx xx xxxxxx xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx on xxx basis of xxxxxxxx xxxxxxxxxxxx and xxxx xxxxxxxxxx according xx the xxxxxxxxxxx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx to xxxxx acceptance xxx xxx. As xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, including segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx xx implemented xxxxx on xxx xxxxxxxxxxx xx data xxxxx and the xxxxx of xxxx xx xxx xxxxxxx xxxxx xx the xxxxxxxxxxxx. There xxxxx xx specific xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx and xxxxxxx source xxxx xxxxx xx xxxxxxxxxx xxx XX xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx xx a secure xxxxxx. Xxxx shall xx taken to xxxxx exposure xx xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Project xxx xxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. A risk xxxxxxxxxx xx xxx major xxxxxxx xx be xxxxxxxx in production xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx testing activities xx systems in xxxxxxxxxx shall xxxx xx xxxxxxxxx according xx a predefined xxxx xxxxx xx the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx security xxxxxxx shall include, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. All xx xxx xxxxxxxxxxxx highlighted xxxxxx xxx security xxxxxxx activities xxxxx xx assessed and xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx shall xx xxxxxxxx xxx xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx in supplier (3) xxxxxxxxxxxxx

Xx ensure xxxxxxxxxx xx the xxxxxxxxxxx’x xxxxxxxx information systems xxxx are xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx with xxxxxxxx’x xxxxxx shall be xxxxxxxxxx and formally xxxxxx xxxx with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx ensure a consistent xxx effective xxxxxxxx xx the xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx, including xxxxxxxxxxxxx xx security xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx and xxxxxxxxxx, xx business xxx xxxxxxxxx level, xxxxx xx xxxxxxxxxxx xxx xxxxxx to ensure x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx xxx xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx to x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx xxxxxxxx xx xx xx xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx procedures xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx review

A participant’s internal xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx network connectivity) xxxxx be xxxxxxxxx xxxxxxxx for compliance xxxx xxx organisation’s xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx xxxxxx xxxx xxx xxx xxxxxxxx xxxxxxxx that xxx xxx xxx physical xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx of xxx xxxxxxxxxx xxx the xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx of different xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx and xxxxxxxxxx xx xxxx xx xxxxxxxx of xxxxxx xxxxxx, xx xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx based xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx xx the xxxx xxxxxxxxxx shall xxxx a similar xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx xxxxxx xxxxx solutions xx xxx Payment Xxxxxxxxxxx Xxxxx xxxx xx xxxxx on a formal xxxx assessment, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx to the xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx the xxxxxxx xxx of xxx xxxxxxxxx xxxxxxx. All xx-xxxxxxxx xxxxxxxxxx of xxx hybrid xxxxxxxxx xxxx be xxxxxxxxxx xxxx xxx other xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx only xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) relate xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Each XXXXXX2 xxxxxxxxxxx classified xx xxx Xxxxxxxxxx xx xxxxx critical xxx xxx xxxxxx xxxxxxxxxxx xx xxx TARGET2 xxxxxx shall have x&xxxx;xxxxxxxx xxxxxxxxxx strategy xx xxxxx xxxxxxxxxx xxx xxxxxxxxx elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx plans xxxxx be xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx xxxx are xx place.
Requirement 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx xxxx xxxxx xx available.
Requirement 2.3	:	Xxx xxxx xxxxxxx xx xxx alternate xxxx shall be xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, xx xxxxx xx avoid xxxx xxxx sites xxx xxxxxxxx xx the xxxx xxxxx xx xxx xxxx time. Xxx xxxxxxx, the xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx circuit xxxx those of xxx xxxxxxx business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx of x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, the xxxxxxxx participant xxxxx xx xxxx to xxxxxx xxxxxx xxxxxxxxxx xxxx the alternate xxxx, where it xxxxx xx possible xx xxxxxxxx xxxxx xxx xxxxxxxx day xxx open the xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx the xxxxxxx xxxxxxxxxx xx xxxxxxx xxx commensurate to xxx xxxxxxxxxxx xx xxx xxxxxxxx xxxx xxx disrupted.
Requirement 2.6	:	The xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx least xxxx x&xxxx;xxxx and xxxxxxxx xxxxx shall be xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx xxx xxxxxx one xxxx.