Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security management

These xxxxxxxxxxxx are xxxxxxxxxx xx each participant, xxxxxx xxx participant xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx xx not xxxxxxxxxx to xx. Xx xxxxxxxxxxxx xxx xxxxx of xxxxxxxxxxx xx the xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx elements xxxx xxx xxxx xx xxx Payment Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx PTC xxxxxx at x&xxxx;Xxxxx xx Entry (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx applications, middleware), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx xxxx the xxxxxxx xx XXXXX (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx policy

The management xxxxx xxx x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx with business xxxxxxxxxx and xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx of xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx xxx xxxxx resilience xxxxxx xxx xxxxxxxxxxxx xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx cyber resilience xxxxx. Xxx policy xxxxxx xxxxxxx at xxxxx xxx following xxxxxxxx: objectives, xxxxx (xxxxxxxxx domains such xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), xxxxxxxxxx xxx xxxxxxxxxx of responsibilities.

Requirement 1.2: Internal xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx established xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx organisation. Xxx management xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment of xxx xxxxxxxxxxx security xxxxxxxxx xx ensure xxx implementation xx xxx xxxxxxxxxxx security xxxxxx (xx per Xxxxxxxxxxx 1.1) xxxxxx xxx organisation, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx and xxxxxxxxxx of security xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx security xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx xxxxxxxxxxx processing xxxxxxxxxx should xxx xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx the xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx or xxxxxxxx/xxxxxxxx xxxxxxxx xx them. Xxx xxxxxx to xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. When xxxxxxxx parties xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx processing xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx xx xxxxxxxxx xxx xxxxxxxx implications xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx xxx defined xx xx xxxxxxxxx xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx systems, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, business xxxxxxxxxxxx, xxx-xxx-xxxxx products, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx the xxxxx xx the Xxxxxxx Transaction Xxxxx xxxxx xx accounted xxx xxx xxxx x&xxxx;xxxxxxxxx owner. The xxxxxxxxxxxxxx for xxx xxxxxxxxxxx and xxx xxxxxxxxx xx appropriate xxxxxxxx xx the xxxxxxxx processes xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx be assigned. Xxxx: xxx xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx as appropriate, xxx remains xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx xx the xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxx xx terms xx xxxxx xxxxxxxxxxx xx xxx xxxxxx delivery xx the xxxxxxx xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx the need, xxxxxxxxxx xxx degree xx protection xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxx xxxx take into xxxxxxxxxxxxx xxx underlying XX components. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx an appropriate xxx xx protection xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) and to xxxxxxxxxxx xxx need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx security

Security responsibilities xxxxx xx addressed xxxxx xx xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx xxx in xxxxx xxx xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx and xxxxx xxxxx users xxxxx xx xxxxxxxxxx screened, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx party xxxxx xx xxxxxxxxxxx xxxxxxxxxx facilities xxxxx xxxx xx xxxxxxxxx xx xxxxx xxxxxxxx xxxxx and responsibilities. Xx xxxxxxxx level xx xxxxxxxxx shall xx ensured xxxxx xxx xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx xxx xxx correct xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx to them xx minimise possible xxxxxxxx xxxxx. A formal xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security xxxxxxxx xxxxx xx established xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx to xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x or third xxxxx xxxx’x exit xxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx managed, and xxxx xxx xxxxxx xx all equipment xxx the removal xx all access xxxxxx are completed.

Requirement 1.7: Xxxxxxxx and xxxxxxxxxxxxx security

Critical xx xxxxxxxxx information processing xxxxxxxxxx xxxxx xx xxxxxx in xxxxxx xxxxx, protected by xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx and interference. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx standards xxxxx be xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx information xxxxxx when in xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx from xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx equipment (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx removal xx xxxxxxxx xx xxxxxxxxx xx reduce the xxxx of unauthorised xxxxxx to information xxx xx guard xxxxxxx xxxx xx xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx be xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and procedures xxxxx xx xxxxxxxxxxx xxx xxx management xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx all xxx xxxxxxxxxx systems xx xxx Payment Transaction Xxxxx end-to-end.

As regards xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx duties shall xx implemented, xxxxx xxxxxxxxxxx, xx xxxxxx xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx misuse. Xxxxx xxxxxxxxxxx of duties xxxxxx xx xxxxxxxxxxx xxx to xxxxxxxxxx xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx awareness) xx prevent, xxxxxx xxx remove malicious xxxx. Mobile xxxx xxxxx xx xxxx xxxx from xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx xxx xxxxxxx) xxxxx xx strictly xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx by xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx of xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular intervals xx least xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx xxx security xx xxxxxxxx shall xx monitored xxx xxxxxx xxxxxxxx to xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx regularly reviewed xx x&xxxx;xxxxxx basis, xxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxxxx. System xxxxxxxxxx xxxxx be xxxx xx xxxxx xxx xxxxxxxxxxxxx xx controls xxxxx xxx identified xx critical xxx xxx security of xxxxxxxx and to xxxxxx xxxxxxxxxx xx xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx xx information xxxxxxx xxxxxxxxxxxxx shall xx xxxxx on x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx in xxxx with xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx the exchange xx xxxxxxxxxxx with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx scenario 2 xx the xxxxx section xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) must xx used xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx assets xxxxx xx justified xx xxx xxxxx xx business xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx the xxxxxxxxxxx xxxxxxxxx xx corporate xxxxxxxx (including xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx based xx xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx xxx xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx and XX processes. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx control xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there are xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx place (x.x. xxxxxxxxxx, personal xxxx xxxxxxxxxxxxx).

Xxxxxx and xxxxxxxxxx xxxxxxxxxx shall xx xx xxxxx to xxxxxxx the xxxxxxxxxx xx xxxxxx xxxxxx xx information systems xxx xxxxxxxx xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx all stages xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx xx new xxxxx xx xxx xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx xx xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx shall be xxxxx, xxxxx xxxxxxxxxxx, xx xxx allocation xx xxxxxx xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx xxxxx xx xxxxx xxxxxx xxxxxx could xxxx xx x&xxxx;xxxxxx adverse xxxxxx xx xxx xxxxxxxxxx of xxx xxxxxxxxxxx (e.g. access xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, direct xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx shall xx xxx xx xxxxx to identify, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx at specific xxxxxx xx the xxxxxxxxxxxx’x network, e.g. xxx xxxxx xxx xxxxxx xxxxxx xx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx shall xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx and enforced xx specific xxxxxxxx xx ensure that xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx xxxxxxxx. A safe xxxxxxxx recovery xxx/xx xxxxx protocol xxxxx xx established.

A policy xxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xx xxx xxx xx cryptographic xxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx integrity xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx shall be xxxxxxxxxxx to xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx shall xx xxxxxx for xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx xxxxx (e.g. x&xxxx;xxxxx screen, x&xxxx;xxxxx xxxx policy) to xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx remotely, xxx xxxxx xx xxxxxxx xx an xxxxxxxxxxx xxxxxxxxxxx shall xx xxxxxxxxxx and xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx be identified xxx agreed prior xx the development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxx xxxx applications, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx systems xxxx process, xx xxxx xx impact xx, xxxxxxxxx, xxxxxxxx xx critical xxxxxxxxxxx. Xxxx controls xxxxx xx xxxxxxxxxx on xxx basis xx xxxxxxxx xxxxxxxxxxxx and xxxx xxxxxxxxxx xxxxxxxxx xx xxx established xxxxxxxx (x.x. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx of xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx xx xxxxx acceptance and xxx. Xx regards xxxxxxx security, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx xxx xxx xxxxx xx xxxx xx xxx xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. There xxxxx xx xxxxxxxx controls xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx files xxx xxxxxxx source code xxxxx be controlled xxx IT xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx xxxxx xx xxxxx exposure of xxxxxxxxx xxxx in xxxx xxxxxxxxxxxx. Project xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx xxxxx be strictly xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx xxx xxxxx xxxxxxx to xx xxxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx shall xxxx xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx xx xxx xxxxxxx of a risk xxxxxxxxxx, and security xxxxxxx shall xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx of xxx shortcomings xxxxxxxxxxx xxxxxx the xxxxxxxx xxxxxxx xxxxxxxxxx shall xx xxxxxxxx and xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx xxxxx be xxxxxxxx xxx xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx ensure protection xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx requirements for xxxxxxxxxx the xxxxx xxxxxxxxxx xxxx supplier’s xxxxxx shall be xxxxxxxxxx and xxxxxxxx xxxxxx xxxx xxxx xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx a consistent xxx effective xxxxxxxx xx xxx xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx events xxx weaknesses, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx and xxxxxx xx ensure x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx xxx safely xxxxxxx xxxx information xxxxxxxx incidents xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx attacker xx xx an xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx procedures xxxxx xx adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx for xxxxxxxxxx xxxx the organisation’s xxxxxxxxxxx framework xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx comply xxxx xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx systems (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx must include: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx operating system, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, logging xxx xxxxxxxxxx xx well xx managing xx xxxxxx xxxxxx, in xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, shall xx implemented xxxxx xx x&xxxx;xxxx assessment. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx hypervisor xxxxx xxxx x&xxxx;xxxxxxx risk xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx xx xxxxxx xxx/xx xxxxxx xxxxx solutions xx xxx Payment Xxxxxxxxxxx Xxxxx xxxx xx xxxxx on a formal xxxx xxxxxxxxxx, taking xxxx xxxxxxx xxx xxxxxxxxx controls and xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx solution.

If hybrid xxxxx xxxxxxxxx are xxxx, xx is xxxxxxxxxx xxxx the xxxxxxxxxxx xxxxx of xxx xxxxxxx xxxxxx xx xxx highest xxx xx xxx xxxxxxxxx xxxxxxx. All xx-xxxxxxxx xxxxxxxxxx xx xxx hybrid xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx only xx critical xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) relate xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx classified xx xxx Xxxxxxxxxx as xxxxx xxxxxxxx xxx xxx xxxxxx xxxxxxxxxxx xx xxx XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx for xxxxxxxxxxx xxxx xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx operational site xxxxx be xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx profile xx the xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx that xx xxx xxxxxxx xxxx, xx xxxxx xx xxxxx xxxx xxxx xxxxx xxx xxxxxxxx by the xxxx xxxxx at xxx xxxx time. Xxx xxxxxxx, the xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid and xxxxxxx telecommunication circuit xxxx xxxxx xx xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx of a major xxxxxxxxxxx disruption xxxxxxxxx xxx primary site xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx unavailable, xxx xxxxxxxx participant shall xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx the alternate xxxx, xxxxx xx xxxxx be xxxxxxxx xx properly close xxx xxxxxxxx xxx xxx xxxx xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxx xxxx the xxxxxxxxxx xx xxxxxxxxxxxx xx xxxxxxx from xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx of xxxxxxx xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx business xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx cope xxxx operational xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx shall xx xxxxxxxxxxxxx xxxxxxx. The xxxxxxx xxxxxx xxxxxxx xxxxx shall not xxxxxx one xxxx.