Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business continuity xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx to xx. Xx xxxxxxxxxxxx the xxxxx xx xxxxxxxxxxx xx the xxxxxxxxxxxx xxxxxx its xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx xxx xxxxxxxx xxxx are part xx the Payment Xxxxxxxxxxx Chain (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx a Point xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx and xxxx-xxxxxx applications, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx to SWIFT (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx xxx latter xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx policy

The xxxxxxxxxx xxxxx xxx a clear xxxxxx direction xx xxxx with xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx to xxxxxxxxxxx xxxxxxxx xxxxxxx the xxxxxxxx, approval and xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxxx xxx organisation xx xxxxx of xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx cyber xxxxxxxxxx xxxxx. The policy xxxxxx xxxxxxx xx xxxxx xxx xxxxxxxxx xxxxxxxx: objectives, xxxxx (xxxxxxxxx xxxxxxx xxxx xx organisation, human xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx and xxxxxxxxxx of xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Internal organisation

An xxxxxxxxxxx xxxxxxxx framework xxxxx xx established xx implement xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx the organisation. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx of xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx xxxxxxxxxxxxxx of xxx xxxxxxxxxxx security xxxxxx (xx xxx Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx security xx xxx xxxxxxxxxxxx’x information xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx xxxxxxxxxxxx xx, xxx/xx xxx xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx xxxxxx xx xxx organisation’s xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx by xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. When xxxxxxxx parties xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx xxxxxxxx xx access xxx xxxxxxxxxxxx’x information xxxxxxxxxx xxxxxxxxxx, a risk xxxxxxxxxx xxxxx xx xxxxxxx xxx xx determine xxx xxxxxxxx xxxxxxxxxxxx xxx control requirements. Xxxxxxxx shall be xxxxxx xxx xxxxxxx xx xx agreement xxxx xxxx relevant xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, xxx business xxxxxxxxx and xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, business xxxxxxxxxxxx, off-the-shelf xxxxxxxx, xxxxxxxx xxx user-developed xxxxxxxxxxxx, in the xxxxx of xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx owner. The xxxxxxxxxxxxxx xxx the xxxxxxxxxxx xxx the xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx the xxxxxxxx processes xxx xxx xxxxxxx XX xxxxxxxxxx to safeguard xxx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxx. Xxxx: the xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx specific xxxxxxxx as xxxxxxxxxxx, xxx remains xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of the xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx classification

Information xxxxxx xxxxx xx xxxxxxxxxx xx xxxxx xx xxxxx criticality xx xxx xxxxxx xxxxxxxx xx xxx service xx xxx participant. Xxx classification xxxxx xxxxxxxx the need, xxxxxxxxxx and degree xx protection xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx shall xxxx take xxxx xxxxxxxxxxxxx xxx underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx of xxxxxxxxxx xxxxxxxx throughout xxx xxxxxxxxxxx asset xxxxxxxxx (xxxxxxxxx removal xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx xxx xxxx xxx xxxxxxxx handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx responsibilities xxxxx be addressed xxxxx xx employment xx xxxxxxxx job xxxxxxxxxxxx xxx xx xxxxx xxx xxxxxxxxxx xx employment. Xxx xxxxxxxxxx for employment, xxxxxxxxxxx and xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx screened, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx facilities shall xxxx an xxxxxxxxx xx xxxxx xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx adequate xxxxx xx awareness shall xx xxxxxxx among xxx employees, xxxxxxxxxxx xxx third party xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx procedures xxx xxx correct xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxxxx xx xxxx xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx process for xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be in xxxxx xx xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx or transfer xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, and xxxx xxx xxxxxx xx all equipment xxx xxx removal xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx security

Critical xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx xx secure xxxxx, xxxxxxxxx xx xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx and entry xxxxxxxx. Xxxx xxxxx xx physically xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx and xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx scope xx Requirement 1.6. Xxxxxxxxxx and standards xxxxx be xxxxxxxxxxx xx xxxxxxx physical xxxxx xxxxxxxxxx information xxxxxx xxxx in xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx from physical xxx xxxxxxxxxxxxx threats. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) xxx against xxx xxxxxxx of xxxxxxxx is xxxxxxxxx xx reduce the xxxx xx unauthorised xxxxxx xx xxxxxxxxxxx xxx xx guard xxxxxxx xxxx xx xxxxxx of xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx be xxxxxxxx to protect xxxxxxx xxxxxxxx threats xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx such xx the xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx be xxxxxxxxxxx xxx the xxxxxxxxxx xxx operation xx xxxxxxxxxxx processing xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx procedures, including xxxxxxxxx xxxxxxxxxxxxxx of XX systems, segregation xx xxxxxx xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx xxxxxx xxx risk xx xxxxxxxxx xx xxxxxxxxxx xxxxxx xxxxxx. Where xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Controls xxxxx xx xxxxxxxxxxx xx prevent xxx xxxxxx xxx introduction xx xxxxxxxxx xxxx xxx systems xx xxx Payment Transaction Xxxxx. Xxxxxxxx shall xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, detect xxx xxxxxx malicious xxxx. Xxxxxx code xxxxx be xxxx xxxx xxxx trusted xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Java Applets). Xxx configuration of xxx xxxxxxx (e.g. xxx use xx xxxxxxxxxx and plugins) xxxxx xx strictly xxxxxxxxxx.

Xxxx xxxxxx and xxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx by xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx a plan of xxx xxxxxxxxxxx xxxxxxx xxxxx is xxxxxx xx xxxxxxx xxxxxxxxx xx xxxxx annually.

Systems xxxx xxx xxxxxxxx xxx the xxxxxxxx xx payments xxxxx xx xxxxxxxxx xxx xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxx xx ensure xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx identified. Xxxxxxxx xxxx shall xx xxxxxxxxx reviewed xx x&xxxx;xxxxxx xxxxx, xxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxxxx. System monitoring xxxxx be xxxx xx check xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx identified xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx access policy xxxxx.

Xxxxxxxxx of information xxxxxxx xxxxxxxxxxxxx xxxxx xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out xx xxxx with xxxxxxxx xxxxxxxxxx among the xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx the exchange xx xxxxxxxxxxx xxxx XXXXXX2 (like software xxxxxxxx xxxx a Service Xxxxxx xx scenario 2 xx xxx xxxxx xxxxxxx of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) must xx used under x&xxxx;xxxxxx agreement with xxx xxxxx party.

Requirement 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx be justified xx xxx basis xx xxxxxxxx requirements (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx the xxxxxxxxxxx security xxxxxx). Xxxxx access xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx xx xxx xxxxxxxxx xx xxxxx privilege (2) xx xxxxxxx xxxxxxx xxx xxxxx of the xxxxxxxxxxxxx xxxxxxxx xxx XX xxxxxxxxx. Xxxxx xxxxxxxx (e.g. for xxxxxx management) logical xxxxxx control xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal data xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx be xx xxxxx to xxxxxxx xxx allocation xx xxxxxx rights xx xxxxxxxxxxx systems xxx services xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx stages xx xxx lifecycle xx user access, xxxx the xxxxxxx xxxxxxxxxxxx of xxx xxxxx to the xxxxx deregistration xx xxxxx xxxx xx xxxxxx require access.

Special xxxxxxxxx xxxxx be xxxxx, where appropriate, xx xxx allocation xx access xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx xxxxx xx xxxxx access xxxxxx could lead xx x&xxxx;xxxxxx adverse xxxxxx on the xxxxxxxxxx xx the xxxxxxxxxxx (x.x. access xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, xxxxxx xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx put in xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local and xxxxxx xxxxxx xx xxxxxxx in the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx shall xxx xx xxxxxx xx xxxxx to xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx shall xx xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx ensure that xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, e.g. xxxxxxxxxx rules xxx xxxxxxx-xxxx validity. A safe xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx developed xxx xxxxxxxxxxx xx xxx xxx of xxxxxxxxxxxxx xxxxxxxx xx xxxxxxx xxx confidentiality, xxxxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx. X&xxxx;xxx management xxxxxx shall xx xxxxxxxxxxx xx support xxx use xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx shall xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx information xx xxxxxx xx xx print (x.x. x&xxxx;xxxxx screen, a clear xxxx xxxxxx) to xxxxxx xxx risk xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx remotely, xxx xxxxx xx xxxxxxx xx an xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx and organisational xxxxxxxx xxxxx be xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, development xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx be identified xxx xxxxxx prior xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx controls xxxxx xx xxxxx xxxx applications, xxxxxxxxx xxxx-xxxxxxxxx applications, xx xxxxxx xxxxxxx processing. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx validation xx xxxxx xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx data. Xxxxxxxxxx xxxxxxxx may be xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, or xxxx xx impact xx, xxxxxxxxx, valuable xx xxxxxxxx xxxxxxxxxxx. Xxxx controls xxxxx xx xxxxxxxxxx on xxx basis xx xxxxxxxx requirements xxx xxxx xxxxxxxxxx according xx xxx xxxxxxxxxxx xxxxxxxx (x.x. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx operational xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx and xxx. As xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx xx implemented xxxxx on xxx xxxxxxxxxxx xx xxxx xxxxx and the xxxxx of risk xx xxx xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. There shall xx xxxxxxxx xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx networks.

Access xx xxxxxx files xxx xxxxxxx xxxxxx xxxx xxxxx be xxxxxxxxxx xxx XX xxxxxxxx xxx xxxxxxx activities xxxxxxxxx xx a secure xxxxxx. Care xxxxx xx xxxxx xx xxxxx xxxxxxxx of xxxxxxxxx xxxx xx xxxx environments. Xxxxxxx xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx the xxxxx xxxxxxx to be xxxxxxxx xx production xxxxx be conducted.

Regular xxxxxxxx xxxxxxx activities xx systems xx xxxxxxxxxx shall xxxx xx conducted xxxxxxxxx xx a predefined xxxx xxxxx xx xxx xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. All xx xxx shortcomings xxxxxxxxxxx xxxxxx xxx xxxxxxxx xxxxxxx activities xxxxx xx xxxxxxxx and xxxxxx xxxxx xx xxxxx any identified xxx xxxxx xx xxxxxxxx and followed xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems xxxx xxx accessible xx xxxxxxxxx, information xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx with xxxxxxxx’x xxxxxx xxxxx be xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx a consistent xxx xxxxxxxxx xxxxxxxx xx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx security xxxxxx xxx weaknesses, xxxxx, xxxxxxxxxxxxxxxx xxx procedures, xx xxxxxxxx xxx xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx to ensure x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx xxx safely xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx to x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx by xx xxxxxxxx xxxxxxxx xx xx an xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx xx adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx xxxxxxx (e.g. xxxx office xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx regularly xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx xxxxxxxxx of xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply with xxx the xxxxxxxx xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx must include: xxxxxxxxx xx the xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx development). Xxxxxxxxxxx xxxxxxxxxx, logging xxx xxxxxxxxxx as xxxx xx xxxxxxxx of xxxxxx rights, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx implemented based xx a risk xxxxxxxxxx. Xxxxx virtual machines xxxxxxx xx the xxxx xxxxxxxxxx xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx usage xx xxxxxx and/or xxxxxx xxxxx solutions xx xxx Payment Xxxxxxxxxxx Xxxxx xxxx be xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx account xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx clauses xxxxxxx xx the xxxxx solution.

If xxxxxx xxxxx solutions xxx xxxx, xx xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx level xx xxx xxxxxxx system xx xxx highest xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx hybrid xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx other xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx only xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) relate xx business xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx as xxxxx xxxxxxxx for xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx continuity xxxxxxxx xx xxxxx xxxxxxxxxx xxx following xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx continuity xxxxx xxxxx xx developed xxx procedures xxx xxxxxxxxxxx them xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx xx available.
Requirement 2.3	:	Xxx risk profile xx xxx xxxxxxxxx xxxx shall xx xxxxxxxxx xxxx that xx xxx xxxxxxx xxxx, xx xxxxx xx avoid xxxx xxxx xxxxx xxx xxxxxxxx xx xxx xxxx event at xxx same xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx primary business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx a major xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx site xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx to xxxxxx xxxxxx operations xxxx xxx alternate xxxx, where it xxxxx be xxxxxxxx xx xxxxxxxx close xxx business xxx xxx xxxx xxx xxxxxxxxx business xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx to xxxxxx xxxx the xxxxxxxxxx of xxxxxxxxxxxx xx resumed from xxx alternate site xxxxxx a reasonable xxxxxxxxx xxxxx xxx initial xxxxxxxxxx xx xxxxxxx xxx commensurate to xxx criticality xx xxx business xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx once x&xxxx;xxxx and xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx trained. Xxx xxxxxxx period xxxxxxx xxxxx shall xxx xxxxxx one xxxx.