Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements xxxxxxxxx xxxxxxxxxxx xxxxxxxx management xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx each xxxxxxxxxxx, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx xx it. Xx xxxxxxxxxxxx the xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx xxx xxxxxxxx xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx PTC xxxxxx at x&xxxx;Xxxxx xx Entry (XxX), x.x. a system xxxxxxxx xx xxx creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, front-office and xxxx-xxxxxx applications, xxxxxxxxxx), xxx ends xx xxx xxxxxx xxxxxxxxxxx xx send xxx xxxxxxx xx XXXXX (x.x. XXXXX XXX Xxx) or Xxxxxxxx (xxxx the xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set a clear xxxxxx xxxxxxxxx in xxxx with business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx of xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx resilience xxxxxx xxx xxxxxxxxxxxx xx xxxxx of xxxxxxxxxxxxxx, xxxxxxxxxx and xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. The xxxxxx xxxxxx xxxxxxx at xxxxx the xxxxxxxxx xxxxxxxx: objectives, xxxxx (xxxxxxxxx xxxxxxx such xx organisation, xxxxx xxxxxxxxx, asset management xxx.), xxxxxxxxxx and xxxxxxxxxx of responsibilities.

Requirement 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx the xxxxxxxxxxxx. Xxx xxxxxxxxxx shall xxxxxxxxxx xxx review xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx security xxxxxx (as xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx of security xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx security xx xxx organisation’s xxxxxxxxxxx xxx information processing xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx introduction of, xxx/xx xxx dependence xx, xx xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx xx xxxx. Xxx access xx xxx organisation’s information xxxxxxxxxx facilities by xxxxxxxx xxxxxxx shall xx controlled. Xxxx xxxxxxxx xxxxxxx or xxxxxxxx/xxxxxxxx of external xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx xx xxxxxxx xxx to determine xxx xxxxxxxx implications xxx control requirements. Xxxxxxxx xxxxx xx xxxxxx xxx defined xx xx xxxxxxxxx xxxx each xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx management

All xxxxxxxxxxx xxxxxx, xxx business xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx products, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx be accounted xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx the xxxxxxxxxxx and xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx xxxxxxxxx xxx xxx related XX xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx xxxxxx xxxxx xx assigned. Xxxx: xxx xxxxx xxx xxxxxxxx the xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx the xxxxxx xxxxxxxxxx of the xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx classification

Information assets xxxxx xx xxxxxxxxxx xx terms xx xxxxx criticality to xxx xxxxxx delivery xx the xxxxxxx xx the xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx protection xxxxxxxx xxxx handling the xxxxxxxxxxx xxxxx in xxx xxxxxxxx xxxxxxxx xxxxxxxxx and xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx the xxxxxxxxxx XX components. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx shall xx xxxx to xxxxxx an xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx removal xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx xxx need xxx specific xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx security

Security xxxxxxxxxxxxxxxx xxxxx xx addressed xxxxx xx xxxxxxxxxx xx adequate job xxxxxxxxxxxx xxx in xxxxx xxx xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx and xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, contractors xxx xxxxx party xxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx an xxxxxxxxx xx xxxxx security xxxxx xxx responsibilities. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx xxxxxxx among xxx xxxxxxxxx, contractors xxx xxxxx party xxxxx, and education xxx training in xxxxxxxx procedures and xxx xxxxxxx use xx information processing xxxxxxxxxx shall xx xxxxxxxx to xxxx xx minimise possible xxxxxxxx risks. A formal xxxxxxxxxxxx process xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx established xxx xxxxxxxxx. Responsibilities xxxxx xx xx xxxxx to xxxxxx xxxx an xxxxxxxx’x, xxxxxxxxxx’x xx third xxxxx user’s exit xxxx xx transfer xxxxxx xxx xxxxxxxxxxxx xx managed, and xxxx xxx return xx all xxxxxxxxx xxx xxx removal xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx and xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx information processing xxxxxxxxxx xxxxx xx xxxxxx xx xxxxxx xxxxx, protected xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx unauthorised xxxxxx, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Requirement 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx when xx xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx physical xxx environmental xxxxxxx. Xxxxxxxxxx xx equipment (xxxxxxxxx equipment xxxx xxx-xxxx) and xxxxxxx xxx removal of xxxxxxxx xx xxxxxxxxx xx xxxxxx the xxxx xx unauthorised xxxxxx xx xxxxxxxxxxx xxx xx xxxxx xxxxxxx xxxx xx xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx may be xxxxxxxx xx protect xxxxxxx xxxxxxxx xxxxxxx xxx to xxxxxxxxx xxxxxxxxxx facilities xxxx xx xxx electrical xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx procedures xxxxx be xxxxxxxxxxx xxx xxx xxxxxxxxxx xxx operation of xxxxxxxxxxx processing xxxxxxxxxx xxxxxxxx all xxx xxxxxxxxxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx procedures, including xxxxxxxxx administration xx XX xxxxxxx, segregation xx duties xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, to xxxxxx xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx misuse. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx be xxxxxxxxxxx xxx xx documented xxxxxxxxx reasons, compensatory xxxxxxxx shall xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx established xx xxxxxxx xxx xxxxxx xxx xxxxxxxxxxxx xx malicious xxxx xxx systems xx xxx Xxxxxxx Transaction Xxxxx. Xxxxxxxx xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx user xxxxxxxxx) xx xxxxxxx, detect xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx used xxxx from trusted xxxxxxx (e.g. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx and xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx backup and xxxxxxxx xxxxxxxx shall xx implemented xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx shall xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx process xxxxx xx xxxxxx xx regular intervals xx least xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx the xxxxxxxx xx payments xxxxx xx xxxxxxxxx xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx security shall xx xxxxxxxx. Operator xxxx xxxxx xx xxxx xx xxxxxx xxxx xxxxxxxxxxx system xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx reviewed xx x&xxxx;xxxxxx xxxxx, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx monitoring xxxxx xx used xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx xxx identified xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx access xxxxxx xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx xxxxx xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx policy, xxxxxxx out xx xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx xxxxxxx xxx xxxxx be compliant xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (xxxx software xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx scenario 2 xx xxx xxxxx xxxxxxx of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) xxxx xx xxxx under x&xxxx;xxxxxx agreement with xxx third party.

Requirement 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx assets xxxxx be xxxxxxxxx xx the xxxxx xx xxxxxxxx requirements (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx access control xxxxx shall xx xxxxxxx xxxxx xx xxx xxxxxxxxx xx xxxxx privilege (2) xx xxxxxxx xxxxxxx xxx xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx xxx XX xxxxxxxxx. Xxxxx xxxxxxxx (e.g. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx control xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx access control xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx controls xx place (x.x. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx and xxxxxxxxxx xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx information xxxxxxx xxx services xxxx xxxx xxxxxx the xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx procedures xxxxx xxxxx xxx xxxxxx xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx the xxxxxxx xxxxxxxxxxxx xx new xxxxx to the xxxxx deregistration xx xxxxx xxxx xx xxxxxx require access.

Special xxxxxxxxx shall be xxxxx, xxxxx xxxxxxxxxxx, xx the allocation xx access xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx xxxxx xx those xxxxxx xxxxxx could lead xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx of xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx controls, xxxxxx xxxxxx to business xxxx).

Xxxxxxxxxxx xxxxxxxx shall xx xxx xx xxxxx xx identify, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx at specific xxxxxx xx xxx xxxxxxxxxxxx’x network, e.g. xxx xxxxx xxx xxxxxx access xx xxxxxxx xx the Xxxxxxx Transaction Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx shall xx xxxxxxxxxxx and xxxxxxxx xx specific controls xx xxxxxx that xxxxxxxxx cannot xx xxxxxx guessed, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx recovery xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx and xxxxxxxxxxx xx xxx xxx of xxxxxxxxxxxxx xxxxxxxx to xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx shall xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx information xx screen or xx xxxxx (e.g. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) to xxxxxx xxx risk xx unauthorised xxxxxx.

Xxxx xxxxxxx remotely, xxx xxxxx xx xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx and xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall be xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxx prior xx xxx development xxx/xx implementation xx xxxxxxxxxxx systems.

Appropriate controls xxxxx xx xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, to xxxxxx correct xxxxxxxxxx. Xxxxx xxxxxxxx shall xxxxxxx the xxxxxxxxxx xx input data, xxxxxxxx processing xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx may be xxxxxxxx for xxxxxxx xxxx xxxxxxx, xx xxxx xx xxxxxx xx, xxxxxxxxx, valuable xx critical xxxxxxxxxxx. Xxxx xxxxxxxx shall xx xxxxxxxxxx on xxx xxxxx xx xxxxxxxx requirements xxx xxxx xxxxxxxxxx xxxxxxxxx xx xxx established xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx to xxxxx acceptance and xxx. As regards xxxxxxx xxxxxxxx, appropriate xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx management, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx xxx xxx xxxxx xx risk xx xxx xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxx sensitive xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx xx controlled xxx XX projects xxx support xxxxxxxxxx xxxxxxxxx xx a secure xxxxxx. Xxxx xxxxx xx taken xx xxxxx xxxxxxxx of xxxxxxxxx data in xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx production xxxxx be xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx the xxxxx xxxxxxx xx be xxxxxxxx in production xxxxx xx conducted.

Regular xxxxxxxx xxxxxxx activities xx xxxxxxx xx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xxxxxxxxx xx a predefined plan xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx shall xxxxxxx, xx least, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx security xxxxxxx activities xxxxx xx xxxxxxxx xxx xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx xxxxx be xxxxxxxx and xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx in xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx ensure xxxxxxxxxx xx the participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx supplier’s xxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx approach xx xxx xxxxxxxxxx xx xxxxxxxxxxx security xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx established xxx xxxxxx xx ensure x&xxxx;xxxxx, effective xxx xxxxxxx and xxxxxx xxxxxxx from xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx xxxxxxxx xx xx an xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx be xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx review

A participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx connectivity) xxxxx be xxxxxxxxx xxxxxxxx xxx compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx xxxxxx with xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx xxx physical xxxxxxxx xxx xxxxxxx (x.x. hardening, xxxxxxx). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx xxxx include: xxxxxxxxx of xxx xxxxxxxxxx and the xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx as xxxx xx xxxxxxxx xx xxxxxx rights, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx implemented xxxxx xx a risk xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx xxxxxxxxxx xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx usage xx xxxxxx xxx/xx hybrid xxxxx solutions xx xxx Payment Xxxxxxxxxxx Xxxxx must be xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, taking xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx clauses xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx hybrid xxxxx solutions are xxxx, it xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx overall xxxxxx xx xxx highest xxx xx xxx xxxxxxxxx systems. All xx-xxxxxxxx xxxxxxxxxx xx xxx hybrid xxxxxxxxx xxxx xx xxxxxxxxxx xxxx the xxxxx xx-xxxxxxxx systems.

Business continuity xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx business xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx xx xxxxx critical for xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx shall xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx plans xxxxx be xxxxxxxxx xxx procedures for xxxxxxxxxxx xxxx are xx xxxxx.
Xxxxxxxxxxx 2.2	:	An xxxxxxxxx operational xxxx xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, xx xxxxx xx xxxxx that xxxx xxxxx xxx xxxxxxxx xx the xxxx xxxxx xx xxx same time. Xxx xxxxxxx, xxx xxxxxxxxx site shall xx xx a different xxxxx xxxx and xxxxxxx xxxxxxxxxxxxxxxxx circuit xxxx xxxxx xx xxx xxxxxxx business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary xxxx xxxxxxxxxxxx and/or xxxxxxxx xxxxx xxxxxxxxxxx, the xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx xx xxxxx xx xxxxxxxx xx properly close xxx business xxx xxx open xxx xxxxxxxxx business day(s).
Requirement 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx that xxx xxxxxxxxxx of transactions xx xxxxxxx xxxx xxx xxxxxxxxx site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx xx xxxxxxx xxx commensurate to xxx xxxxxxxxxxx xx xxx xxxxxxxx that xxx disrupted.
Requirement 2.6	:	The xxxxxxx xx xxxx xxxx operational xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx once x&xxxx;xxxx and xxxxxxxx xxxxx shall xx xxxxxxxxxxxxx trained. Xxx xxxxxxx xxxxxx between xxxxx xxxxx xxx xxxxxx xxx xxxx.