Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx security management xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx management

These xxxxxxxxxxxx xxx applicable xx each participant, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx xx xx. Xx establishing the xxxxx xx application xx xxx requirements xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx the xxxxxxxx xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain (XXX). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. a system xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, middleware), xxx xxxx xx xxx xxxxxx responsible xx xxxx the xxxxxxx xx XXXXX (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx the latter xxxxxxxxxx to Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx policy

The management xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx in xxxx with xxxxxxxx xxxxxxxxxx xxx demonstrate xxxxxxx for xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, approval xxx xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx managing xxxxxxxxxxx security and xxxxx resilience xxxxxx xxx organisation xx xxxxx xx identification, xxxxxxxxxx and treatment xx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. The xxxxxx xxxxxx contain xx xxxxx xxx following xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx domains xxxx xx organisation, xxxxx xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), xxxxxxxxxx and xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx security policy xxxxxx xxx organisation. Xxx xxxxxxxxxx shall xxxxxxxxxx and xxxxxx xxx establishment of xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx ensure xxx xxxxxxxxxxxxxx xx xxx information security xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx security xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx security of xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx xxx xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx xx xxxx. Xxx xxxxxx xx xxx organisation’s xxxxxxxxxxx xxxxxxxxxx facilities by xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. When xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx xxxxxxxx xx access the xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx be carried xxx xx xxxxxxxxx xxx xxxxxxxx xxxxxxxxxxxx xxx control xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx xxx defined xx xx xxxxxxxxx xxxx xxxx xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, the xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx operating xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx and user-developed xxxxxxxxxxxx, in the xxxxx of xxx Xxxxxxx Transaction Chain xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx for xxx xxxxxxxxxxx xxx the xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx xxxxxxxxx and xxx xxxxxxx IT xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx assets xxxxx xx assigned. Xxxx: xxx xxxxx xxx delegate xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxx xx xxxxx xx xxxxx criticality to xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx xxx participant. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx the xxxx, xxxxxxxxxx and xxxxxx xx xxxxxxxxxx required xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx and xxxxx xxxx take xxxx xxxxxxxxxxxxx the underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx approved xx xxx xxxxxxxxxx shall xx used to xxxxxx xx xxxxxxxxxxx xxx xx protection xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx of information xxxxxx) xxx xx xxxxxxxxxxx xxx need xxx specific xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx responsibilities xxxxx xx xxxxxxxxx xxxxx to xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx and in xxxxx and xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx for xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx party xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx agreement xx xxxxx xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx adequate level xx awareness xxxxx xx xxxxxxx xxxxx xxx xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, and education xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx and xxx xxxxxxx xxx xx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx to xxxx xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx for xxxxxxxx security xxxxxxxx xxxxx be xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx xx in xxxxx to xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx xx xxxxxxxx xxxxxx xxx organisation xx managed, xxx xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx xxx xxxxxxx xx xxx xxxxxx xxxxxx xxx completed.

Requirement 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx information xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx in xxxxxx xxxxx, protected by xxxxxxx security perimeters, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. They xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx unauthorised access, xxxxxx and interference. Xxxxxx xxxxx be xxxxxxx xxxx xx xxxxxxxxxxx who xxxx xxxxxx the xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx in xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx from xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx xxxxxx xxx xxxx of xxxxxxxxxxxx xxxxxx xx xxxxxxxxxxx xxx to guard xxxxxxx xxxx or xxxxxx xx xxxxxxxxx xx information. Xxxxxxx xxxxxxxx xxx be xxxxxxxx to xxxxxxx xxxxxxx physical xxxxxxx xxx xx safeguard xxxxxxxxxx xxxxxxxxxx such xx the electrical xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx be xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx processing facilities xxxxxxxx xxx the xxxxxxxxxx systems xx xxx Payment Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, including xxxxxxxxx xxxxxxxxxxxxxx of XX xxxxxxx, segregation xx xxxxxx xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, to xxxxxx xxx risk xx xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx of xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx following a formal xxxx analysis. Xxxxxxxx xxxxx be xxxxxxxxxxx xx prevent xxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Payment Transaction Xxxxx. Xxxxxxxx shall xx also xxxxxxxxxxx (xxxxxxxxx user xxxxxxxxx) xx xxxxxxx, xxxxxx xxx xxxxxx malicious xxxx. Mobile xxxx xxxxx be used xxxx from trusted xxxxxxx (e.g. xxxxxx Xxxxxxxxx XXX components xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx xxx plugins) xxxxx xx strictly xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx xxxxx xx implemented xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx xx xxx restoration xxxxxxx xxxxx is tested xx regular xxxxxxxxx xx xxxxx annually.

Systems xxxx xxx critical xxx xxx xxxxxxxx xx payments xxxxx xx xxxxxxxxx and xxxxxx xxxxxxxx to xxxxxxxxxxx security xxxxx xx recorded. Xxxxxxxx xxxx xxxxx be xxxx to ensure xxxx information xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx shall xx xxxxxxxxx xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on the xxxxxxxxxxx xx the xxxxxxxxxx. System xxxxxxxxxx xxxxx xx used xx xxxxx the xxxxxxxxxxxxx of xxxxxxxx xxxxx xxx identified xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx xxx xx xxxxxx conformity to xx access xxxxxx xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx shall xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx policy, xxxxxxx xxx in xxxx xxxx xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx compliant xxxx xxx relevant xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx components employed xx the xxxxxxxx xx information with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 of the xxxxx xxxxxxx of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx agreement xxxx xxx xxxxx party.

Requirement 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx of xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx security xxxxxx). Xxxxx xxxxxx control xxxxx shall be xxxxxxx xxxxx xx xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) to xxxxxxx closely the xxxxx xx xxx xxxxxxxxxxxxx business and XX processes. Xxxxx xxxxxxxx (e.g. xxx xxxxxx management) xxxxxxx xxxxxx control should xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there are xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal xxxx xxxxxxxxxxxxx).

Xxxxxx and xxxxxxxxxx xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx systems xxx xxxxxxxx that xxxx within xxx xxxxx of the Xxxxxxx Xxxxxxxxxxx Chain. Xxx xxxxxxxxxx xxxxx xxxxx all xxxxxx xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx xx xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx of xxxxx xxxx no xxxxxx xxxxxxx access.

Special xxxxxxxxx shall be xxxxx, where appropriate, xx the allocation xx xxxxxx rights xx such xxxxxxxxxxx xxxx xxx xxxxx xx those xxxxxx xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (e.g. xxxxxx xxxxxx allowing xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx controls xxxxx xx xxx in xxxxx to xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx at xxxxxxxx xxxxxx xx the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx xxxxx xxx xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx xxxxxxxx xxxxx xxx be xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx be xxxxxxxxxxx and enforced xx xxxxxxxx xxxxxxxx xx xxxxxx xxxx xxxxxxxxx cannot xx xxxxxx guessed, x.x. xxxxxxxxxx xxxxx and xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx xxxxxxxx and/or xxxxx protocol shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx developed xxx xxxxxxxxxxx on xxx xxx xx cryptographic xxxxxxxx to protect xxx xxxxxxxxxxxxxxx, authenticity xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx or xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx policy) xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, the xxxxx xx xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx shall xx xxxxxxxxxx and xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall be xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, xxxxxxxxxxx xxx maintenance

Security xxxxxxxxxxxx xxxxx xx identified xxx xxxxxx xxxxx xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx controls xxxxx xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx and xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx for xxxxxxx xxxx xxxxxxx, or xxxx xx xxxxxx xx, sensitive, xxxxxxxx xx critical xxxxxxxxxxx. Xxxx xxxxxxxx shall xx xxxxxxxxxx on xxx xxxxx xx xxxxxxxx requirements and xxxx xxxxxxxxxx xxxxxxxxx xx the xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx of xxx xxxxxxx xxxxx be xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx prior to xxxxx xxxxxxxxxx xxx xxx. As xxxxxxx xxxxxxx security, appropriate xxxxxxxx, including xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx be xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx and the xxxxx xx risk xx the network xxxxx xx xxx xxxxxxxxxxxx. There xxxxx xx xxxxxxxx xxxxxxxx xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx networks.

Access xx xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx xx xxxxxxxxxx xxx IT xxxxxxxx xxx xxxxxxx activities xxxxxxxxx xx a secure xxxxxx. Xxxx xxxxx xx xxxxx to xxxxx xxxxxxxx xx xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx in production xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx xxxxx xxxxxxx xx be xxxxxxxx xx production xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx activities xx xxxxxxx in xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xxxxxxxxx xx a predefined xxxx xxxxx xx the xxxxxxx of a risk xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. All of xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx security xxxxxxx activities xxxxx xx xxxxxxxx and xxxxxx xxxxx xx xxxxx any identified xxx shall xx xxxxxxxx xxx xxxxxxxx xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx in supplier (3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx the participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx for xxxxxxxxxx xxx xxxxx xxxxxxxxxx with xxxxxxxx’x xxxxxx xxxxx be xxxxxxxxxx xxx formally xxxxxx upon xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx ensure a consistent xxx xxxxxxxxx xxxxxxxx xx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx xxxxxx xxx weaknesses, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx and xxxxxx xxxxxxx from information xxxxxxxx xxxxxxxxx including xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx attacker xx by xx xxxxxxx). Xxxxxxxxx involved xx xxxxx xxxxxxxxxx xxxxx be xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx review

A participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx networks xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx regularly xxxxxxxx xxx compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx xxxxxx xxxx xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx for physical xxxxxxxx xxx systems (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx relating xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx operating xxxxxx, xxxxxxx xxxxxxxx, strict xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, logging and xxxxxxxxxx xx xxxx xx managing of xxxxxx xxxxxx, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx implemented xxxxx xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx xx xxx xxxx xxxxxxxxxx shall xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx xx xxxxxx xxx/xx xxxxxx xxxxx solutions xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx xx xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx account the xxxxxxxxx xxxxxxxx xxx xxx contractual xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx xxxxx of xxx overall xxxxxx xx the xxxxxxx xxx of xxx xxxxxxxxx systems. Xxx xx-xxxxxxxx components of xxx hybrid xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx as xxxxx critical xxx xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx shall xxxx x&xxxx;xxxxxxxx continuity strategy xx xxxxx comprising xxx following xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx continuity plans xxxxx be xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx xxxx xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx xxxx xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx risk xxxxxxx xx the xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, xx xxxxx xx xxxxx that xxxx xxxxx are xxxxxxxx xx xxx xxxx xxxxx xx xxx xxxx xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx xxxxx xx on a different xxxxx xxxx xxx xxxxxxx telecommunication xxxxxxx xxxx xxxxx of xxx xxxxxxx business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx of x&xxxx;xxxxx xxxxxxxxxxx disruption xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx and/or xxxxxxxx xxxxx unavailable, the xxxxxxxx participant xxxxx xx xxxx xx xxxxxx normal xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx xx xxxxx xx possible xx xxxxxxxx close xxx xxxxxxxx day xxx open the xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx resumed xxxx xxx xxxxxxxxx site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx of xxxxxxx xxx xxxxxxxxxxxx xx xxx criticality xx xxx business xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx once x&xxxx;xxxx xxx critical xxxxx xxxxx be xxxxxxxxxxxxx trained. Xxx xxxxxxx period xxxxxxx xxxxx xxxxx not xxxxxx xxx xxxx.