Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx management xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx management

These xxxxxxxxxxxx xxx applicable xx xxxx participant, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx xx xx. Xx xxxxxxxxxxxx xxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx participant xxxxxx xxxxxxxx xxx elements xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, xxx XXX xxxxxx at x&xxxx;Xxxxx xx Xxxxx (PoE), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, middleware), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx xxxx the xxxxxxx xx XXXXX (x.x. SWIFT XXX Xxx) or Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx xxx x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx xxxx xxxxxxxx xxxxxxxxxx xxx demonstrate xxxxxxx xxx and xxxxxxxxxx to xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx of xx xxxxxxxxxxx security policy xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx across xxx organisation xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx information security xxx xxxxx xxxxxxxxxx xxxxx. Xxx xxxxxx xxxxxx xxxxxxx at xxxxx xxx xxxxxxxxx xxxxxxxx: objectives, xxxxx (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), xxxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Internal xxxxxxxxxxxx

Xx xxxxxxxxxxx security framework xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx xxxxxxxxxxxx. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx xx xxx information xxxxxxxx xxxxxxxxx xx ensure xxx xxxxxxxxxxxxxx of xxx xxxxxxxxxxx security xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx allocation of xxxxxxxxxx xxxxxxxxx and xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx this xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x information xxx xxxxxxxxxxx processing xxxxxxxxxx xxxxxx xxx xx xxxxxxx by xxx introduction of, xxx/xx the xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx by xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x information xxxxxxxxxx facilities xx xxxxxxxx parties xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx parties or xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx xxxxxxxx xx xxxxxx the xxxxxxxxxxxx’x information processing xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx xx xxxxxxx xxx to xxxxxxxxx xxx xxxxxxxx xxxxxxxxxxxx xxx control requirements. Xxxxxxxx shall be xxxxxx and xxxxxxx xx xx xxxxxxxxx xxxx each relevant xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx management

All information xxxxxx, xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx products, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, in the xxxxx of xxx Xxxxxxx Xxxxxxxxxxx Chain xxxxx xx accounted xxx and xxxx x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx xxx the xxxxxxxxxxx xxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx processes and xxx xxxxxxx XX xxxxxxxxxx to xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxx. Xxxx: xxx xxxxx xxx delegate the xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx appropriate, xxx remains xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx classification

Information xxxxxx xxxxx xx xxxxxxxxxx xx terms of xxxxx criticality xx xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx xxx participant. Xxx classification xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx and xxxxx xxxx xxxx into xxxxxxxxxxxxx xxx underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx classification xxxxxx xxxxxxxx by xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxx throughout xxx xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx of xxxxxxxxxxx xxxxxx) xxx to xxxxxxxxxxx xxx xxxx xxx specific xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx to xxxxxxxxxx xx adequate job xxxxxxxxxxxx and xx xxxxx and conditions xx employment. Xxx xxxxxxxxxx for xxxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx facilities xxxxx xxxx an xxxxxxxxx xx xxxxx security xxxxx xxx xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx ensured xxxxx xxx xxxxxxxxx, contractors xxx third xxxxx xxxxx, and education xxx training in xxxxxxxx procedures xxx xxx xxxxxxx use xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxxxx xx them xx xxxxxxxx xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx process xxx xxxxxxxx xxxxxxxx breaches xxxxx xx established xxx employees. Responsibilities xxxxx be xx xxxxx to xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x exit xxxx xx transfer xxxxxx xxx organisation xx xxxxxxx, xxx xxxx xxx return xx all xxxxxxxxx xxx the xxxxxxx xx xxx xxxxxx xxxxxx are xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx xx secure xxxxx, xxxxxxxxx xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx and xxxxx xxxxxxxx. Xxxx xxxxx xx physically protected xxxx unauthorised access, xxxxxx xxx interference. Xxxxxx xxxxx be xxxxxxx only to xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Requirement 1.6. Xxxxxxxxxx xxx standards xxxxx be established xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx when xx xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx from xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) and against xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx xxxxxx the xxxx of unauthorised xxxxxx to information xxx to guard xxxxxxx loss or xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx xxx xx xxxxxxxx to protect xxxxxxx xxxxxxxx xxxxxxx xxx xx xxxxxxxxx xxxxxxxxxx facilities xxxx xx xxx xxxxxxxxxx xxxxxx xxx cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and procedures xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx processing xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Transaction Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, segregation xx xxxxxx shall xx implemented, where xxxxxxxxxxx, to xxxxxx xxx risk xx xxxxxxxxx xx deliberate xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx documented xxxxxxxxx xxxxxxx, compensatory xxxxxxxx xxxxx xx xxxxxxxxxxx following x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxxxxx the xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx systems in xxx Payment Xxxxxxxxxxx Xxxxx. Xxxxxxxx shall xx also established (xxxxxxxxx user awareness) xx xxxxxxx, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx xxxx xxxxxxx xxxxxxx (x.x. signed Xxxxxxxxx COM components xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (e.g. xxx xxx xx xxxxxxxxxx xxx xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx backup xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx by xxx xxxxxxxxxx; those xxxxxxxx policies xxxxx xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx process xxxxx xx xxxxxx xx xxxxxxx xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx xxx security xx payments xxxxx xx xxxxxxxxx xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx xxxxxxxx shall xx recorded. Operator xxxx xxxxx xx xxxx xx xxxxxx xxxx xxxxxxxxxxx system xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx shall xx xxxxxxxxx reviewed xx x&xxxx;xxxxxx basis, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. System xxxxxxxxxx xxxxx xx xxxx xx check xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx xxx xxxxxxxxxx xx xxxxxxxx xxx xxx security xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx xxxxxx policy xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx organisations xxxxx xx based on x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out in xxxx with xxxxxxxx xxxxxxxxxx among the xxxxxxxx xxxxxxx xxx xxxxx be xxxxxxxxx xxxx xxx relevant xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (like xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx in xxxxxxxx 2 of xxx xxxxx xxxxxxx xx xxx TARGET2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx under x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx information xxxxxx xxxxx be justified xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) and according xx the xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx on xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely the xxxxx xx xxx xxxxxxxxxxxxx business xxx XX xxxxxxxxx. Xxxxx xxxxxxxx (x.x. xxx xxxxxx management) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx access xxxxxxx xxxxxx there xxx xxxxxxxx compensatory xxxxxxxx xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx xxxxxx rights xx xxxxxxxxxxx xxxxxxx xxx services xxxx xxxx within xxx xxxxx xx xxx Xxxxxxx Transaction Chain. Xxx procedures xxxxx xxxxx all xxxxxx xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx xxx initial xxxxxxxxxxxx xx new xxxxx xx the xxxxx xxxxxxxxxxxxxx of xxxxx that xx xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx be xxxxx, where appropriate, xx xxx xxxxxxxxxx xx xxxxxx rights xx xxxx criticality xxxx xxx xxxxx xx those access xxxxxx xxxxx xxxx xx a severe xxxxxxx xxxxxx on xxx xxxxxxxxxx of xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx allowing xxxxxx xxxxxxxxxxxxxx, override of xxxxxx xxxxxxxx, direct xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx authorise xxxxx at specific xxxxxx xx the xxxxxxxxxxxx’x network, e.g. xxx xxxxx xxx xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Transaction Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx order xx xxxxxx accountability.

For passwords, xxxxx xxxxx be xxxxxxxxxxx xxx enforced xx specific controls xx xxxxxx xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. A safe xxxxxxxx xxxxxxxx and/or xxxxx protocol xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx developed xxx xxxxxxxxxxx xx xxx xxx of xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx integrity xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx shall xx xxxxxxxxxxx xx xxxxxxx xxx xxx of xxxxxxxxxxxxx xxxxxxxx.

Xxxxx shall xx xxxxxx for xxxxxxx xxxxxxxxxxxx information xx screen xx xx print (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) to xxxxxx the xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx xx working xx an xxxxxxxxxxx xxxxxxxxxxx shall xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx and xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be identified xxx xxxxxx xxxxx xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxx xxxx xxxxxxxxxxxx, including xxxx-xxxxxxxxx xxxxxxxxxxxx, to xxxxxx correct xxxxxxxxxx. Xxxxx controls xxxxx xxxxxxx xxx xxxxxxxxxx xx xxxxx xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, or xxxx xx xxxxxx xx, xxxxxxxxx, xxxxxxxx xx xxxxxxxx information. Xxxx controls shall xx xxxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx and xxxx assessment according xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx of new xxxxxxx xxxxx be xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx prior xx xxxxx xxxxxxxxxx xxx xxx. As xxxxxxx xxxxxxx security, xxxxxxxxxxx xxxxxxxx, including segmentation xxx xxxxxx management, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx and the xxxxx xx xxxx xx xxx xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx to xxxxxx files xxx xxxxxxx xxxxxx code xxxxx xx xxxxxxxxxx xxx XX projects xxx support xxxxxxxxxx xxxxxxxxx xx a secure xxxxxx. Xxxx xxxxx xx xxxxx xx xxxxx exposure xx xxxxxxxxx xxxx in xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx xxx major xxxxxxx xx xx xxxxxxxx in xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx activities xx systems xx xxxxxxxxxx xxxxx also xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx xxxx xxxxx on the xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx least, vulnerability xxxxxxxxxxx. Xxx xx xxx shortcomings xxxxxxxxxxx xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx assessed xxx xxxxxx xxxxx to xxxxx xxx identified xxx xxxxx be xxxxxxxx xxx xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx are accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx for xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx xx xxxxxxxxxx and xxxxxxxx xxxxxx xxxx with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx a consistent xxx effective xxxxxxxx xx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx weaknesses, roles, xxxxxxxxxxxxxxxx xxx procedures, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx xx ensure x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx xxx xxxxxx xxxxxxx from xxxxxxxxxxx xxxxxxxx xxxxxxxxx including xxxxxxxxx related to x&xxxx;xxxxx-xxxxxxx cause (e.g. x&xxxx;xxxxx xxxxxxx xx xx external attacker xx xx xx xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (e.g. xxxx xxxxxx systems, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, cryptographic xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx xxxxxx xxxx xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx for physical xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx must xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx xxxxxxxx, strict xxxxxxxxxx xx different xxxxxxxxxxxx (x.x. production xxx xxxxxxxxxxx). Centralised xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx xxxxxxxx xx xxxxxx rights, in xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx based xx a risk xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx by the xxxx xxxxxxxxxx xxxxx xxxx a similar risk xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx hybrid xxxxx xxxxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx xx xxxxx xx x&xxxx;xxxxxx xxxx assessment, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx controls xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx to xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx level xx xxx overall system xx xxx xxxxxxx xxx xx the xxxxxxxxx systems. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx hybrid xxxxxxxxx xxxx xx segregated xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx continuity xxxxxxxxxx (xxxxxxxxxx xxxx xx critical xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx classified xx xxx Xxxxxxxxxx as xxxxx xxxxxxxx xxx xxx xxxxxx xxxxxxxxxxx xx xxx XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx strategy xx place xxxxxxxxxx xxx following elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx plans xxxxx xx developed xxx xxxxxxxxxx for xxxxxxxxxxx xxxx xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx be xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx be xxxxxxxxx from xxxx xx the xxxxxxx xxxx, in order xx avoid xxxx xxxx xxxxx xxx xxxxxxxx xx xxx xxxx event at xxx xxxx xxxx. Xxx xxxxxxx, the xxxxxxxxx xxxx shall xx xx a different xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx of a major xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx xxx/xx critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx participant xxxxx xx able to xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx xx xxxxx be xxxxxxxx xx properly xxxxx xxx xxxxxxxx xxx xxx xxxx the xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx xxx xxxxxxx xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx xx xxx criticality xx xxx xxxxxxxx that xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx cope xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx xxxx x&xxxx;xxxx and xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx between xxxxx shall xxx xxxxxx xxx xxxx.