Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements regarding xxxxxxxxxxx security xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx are xxxxxxxxxx xx each xxxxxxxxxxx, xxxxxx xxx participant xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx xx xxx xxxxxxxxxx xx xx. Xx establishing the xxxxx xx application xx the requirements xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx the elements xxxx xxx part xx xxx Payment Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, the XXX xxxxxx at x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, front-office xxx xxxx-xxxxxx applications, xxxxxxxxxx), xxx ends at xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx xx XXXXX (x.x. SWIFT VPN Xxx) or Xxxxxxxx (xxxx xxx latter xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx in xxxx xxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx for xxx xxxxxxxxxx to information xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx managing xxxxxxxxxxx security and xxxxx resilience xxxxxx xxx xxxxxxxxxxxx in xxxxx xx identification, xxxxxxxxxx xxx treatment xx information security xxx xxxxx resilience xxxxx. Xxx xxxxxx xxxxxx xxxxxxx xx xxxxx the following xxxxxxxx: xxxxxxxxxx, scope (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx framework xxxxx be established xx xxxxxxxxx the xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx the xxxxxxxxxxxx. Xxx xxxxxxxxxx shall xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx security xxxxxxxxx to ensure xxx xxxxxxxxxxxxxx of xxx information security xxxxxx (as per Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, including xxx xxxxxxxxxx xx xxxxxxxxxx resources xxx xxxxxxxxxx of security xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx security of xxx xxxxxxxxxxxx’x information xxx information xxxxxxxxxx xxxxxxxxxx xxxxxx not xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx the xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx xx them. Xxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx facilities by xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx required xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx be xxxxxxx xxx to determine xxx security implications xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx shall xx xxxxxx xxx defined xx an xxxxxxxxx xxxx each xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx management

All xxxxxxxxxxx xxxxxx, the xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx systems, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx products, xxxxxxxx xxx user-developed xxxxxxxxxxxx, in xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain xxxxx xx xxxxxxxxx xxx and have x&xxxx;xxxxxxxxx owner. The xxxxxxxxxxxxxx for the xxxxxxxxxxx and xxx xxxxxxxxx xx appropriate xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx and xxx xxxxxxx XX xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx xxxxxx xxxxx be assigned. Xxxx: xxx owner xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx as xxxxxxxxxxx, xxx xxxxxxx accountable xxx the proper xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxx xx terms xx xxxxx criticality xx xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx xxx participant. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx handling xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxxx business xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx the xxxxxxxxxx XX xxxxxxxxxx. An xxxxxxxxxxx asset xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx shall xx xxxx to xxxxxx xx appropriate xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx information xxxxxx) xxx to xxxxxxxxxxx the xxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx security

Security xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx job xxxxxxxxxxxx xxx xx xxxxx xxx xxxxxxxxxx xx employment. Xxx xxxxxxxxxx for xxxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx shall xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Employees, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx of xxxxxxxxxxx xxxxxxxxxx facilities shall xxxx xx xxxxxxxxx xx xxxxx xxxxxxxx xxxxx xxx responsibilities. Xx xxxxxxxx xxxxx xx awareness xxxxx xx xxxxxxx among xxx xxxxxxxxx, contractors xxx xxxxx xxxxx xxxxx, and xxxxxxxxx xxx training in xxxxxxxx procedures xxx xxx xxxxxxx xxx xx information xxxxxxxxxx xxxxxxxxxx shall be xxxxxxxx xx them xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security xxxxxxxx xxxxx be xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx xx ensure xxxx xx employee’s, xxxxxxxxxx’x xx xxxxx xxxxx user’s xxxx xxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx managed, xxx xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx xxx xxxxxxx xx xxx access xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Physical xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx in secure xxxxx, protected xx xxxxxxx xxxxxxxx perimeters, xxxx xxxxxxxxxxx security xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx physically xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx fall xxxxxx the xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx standards xxxxx xx xxxxxxxxxxx xx protect xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx in xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) xxx against xxx removal xx xxxxxxxx xx xxxxxxxxx xx reduce the xxxx xx xxxxxxxxxxxx xxxxxx xx xxxxxxxxxxx xxx xx guard xxxxxxx xxxx xx xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx xxx be xxxxxxxx xx protect xxxxxxx xxxxxxxx threats xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx such xx xxx xxxxxxxxxx xxxxxx and xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx operation xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx the xxxxxxxxxx systems xx xxx Xxxxxxx Transaction Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, including xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx duties shall xx implemented, where xxxxxxxxxxx, to xxxxxx xxx xxxx xx xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx duties xxxxxx xx xxxxxxxxxxx xxx xx documented xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx shall be xxxxxxxxxxx xxxxxxxxx a formal xxxx xxxxxxxx. Controls xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Controls xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx awareness) xx xxxxxxx, detect xxx remove malicious xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx xxxx trusted xxxxxxx (x.x. signed Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (e.g. xxx use xx xxxxxxxxxx xxx xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx backup and xxxxxxxx xxxxxxxx shall xx implemented xx xxx management; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx xxxxxxx xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx xxx xxxxxxxx xx payments xxxxx xx xxxxxxxxx xxx xxxxxx xxxxxxxx to xxxxxxxxxxx security xxxxx xx xxxxxxxx. Xxxxxxxx xxxx xxxxx be xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx shall xx xxxxxxxxx reviewed xx a sample basis, xxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx xxxx xx check the xxxxxxxxxxxxx of xxxxxxxx xxxxx are xxxxxxxxxx xx xxxxxxxx xxx xxx security xx xxxxxxxx and xx xxxxxx xxxxxxxxxx xx xx xxxxxx policy xxxxx.

Xxxxxxxxx xx information xxxxxxx xxxxxxxxxxxxx xxxxx xx based xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx in xxxx xxxx xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx parties xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Third xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxx with XXXXXX2 (like xxxxxxxx xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx in scenario 2 xx xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx third party.

Requirement 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx assets xxxxx be justified xx the xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx according xx xxx established xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx security xxxxxx). Xxxxx xxxxxx control xxxxx xxxxx xx xxxxxxx xxxxx on xxx xxxxxxxxx of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely xxx xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Where xxxxxxxx (x.x. for xxxxxx management) logical xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx access control xxxxxx xxxxx xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal data xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxxx the allocation xx access xxxxxx xx xxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxx xxxx xxxxxx xxx xxxxx of xxx Xxxxxxx Transaction Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx stages xx xxx xxxxxxxxx xx user access, xxxx the initial xxxxxxxxxxxx xx new xxxxx xx the xxxxx deregistration xx xxxxx xxxx xx xxxxxx require access.

Special xxxxxxxxx shall be xxxxx, xxxxx xxxxxxxxxxx, xx the xxxxxxxxxx xx xxxxxx xxxxxx xx such criticality xxxx xxx abuse xx xxxxx xxxxxx xxxxxx xxxxx lead xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx of xxx xxxxxxxxxxx (e.g. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx controls, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx xx identify, xxxxxxxxxxxx and xxxxxxxxx xxxxx at xxxxxxxx xxxxxx in the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local xxx xxxxxx xxxxxx xx xxxxxxx xx xxx Xxxxxxx Transaction Xxxxx. Xxxxxxxx accounts shall xxx be xxxxxx xx xxxxx xx xxxxxx accountability.

For passwords, xxxxx xxxxx be xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx controls xx ensure xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx recovery xxx/xx xxxxx protocol shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx and xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx to xxxxxxx xxx confidentiality, authenticity xxx integrity of xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx shall xx xxxxxxxxxxx to xxxxxxx xxx xxx of xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx xxx xxxx xx unauthorised xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx of xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx xxx organisational xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxx xxxxx xx the xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx correct xxxxxxxxxx. Xxxxx controls shall xxxxxxx the xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, or xxxx xx xxxxxx xx, sensitive, xxxxxxxx xx critical information. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx xx xxx xxxxx xx xxxxxxxx requirements and xxxx assessment according xx the xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, cryptographic xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx of xxx xxxxxxx xxxxx be xxxxxxxxxxx, xxxxxxxxxx and xxxxxx xxxxx xx xxxxx xxxxxxxxxx xxx xxx. Xx regards xxxxxxx xxxxxxxx, appropriate xxxxxxxx, including xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx be xxxxxxxxxxx xxxxx on the xxxxxxxxxxx xx xxxx xxxxx and xxx xxxxx xx xxxx xx the network xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx specific controls xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx to xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx xx controlled xxx IT xxxxxxxx xxx xxxxxxx activities xxxxxxxxx in a secure xxxxxx. Xxxx shall xx taken xx xxxxx xxxxxxxx of xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx production xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx the major xxxxxxx xx xx xxxxxxxx xx production xxxxx xx conducted.

Regular xxxxxxxx xxxxxxx xxxxxxxxxx xx systems xx xxxxxxxxxx xxxxx also xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx least, vulnerability xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx highlighted xxxxxx the xxxxxxxx xxxxxxx activities xxxxx xx xxxxxxxx and xxxxxx xxxxx to xxxxx xxx identified xxx xxxxx be xxxxxxxx xxx xxxxxxxx xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx ensure xxxxxxxxxx xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx for xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx shall be xxxxxxxxxx and formally xxxxxx upon with xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx information xxxxxxxx incidents and xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx approach xx xxx xxxxxxxxxx xx xxxxxxxxxxx security xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx security xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx business and xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx and xxxxxx xx ensure x&xxxx;xxxxx, effective xxx xxxxxxx xxx xxxxxx xxxxxxx from xxxxxxxxxxx xxxxxxxx incidents including xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx xxxxx (e.g. x&xxxx;xxxxx xxxxxxx by xx xxxxxxxx xxxxxxxx xx by xx xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx (e.g. xxxx xxxxxx xxxxxxx, xxxxxxxx networks xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx for compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx comply with xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx for physical xxxxxxxx xxx xxxxxxx (x.x. hardening, logging). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx xxx the xxxxxxx operating xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx development). Centralised xxxxxxxxxx, xxxxxxx and xxxxxxxxxx xx well xx xxxxxxxx xx xxxxxx rights, in xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, shall xx xxxxxxxxxxx xxxxx xx a risk xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx xx the xxxx hypervisor shall xxxx x&xxxx;xxxxxxx risk xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx usage of xxxxxx xxx/xx hybrid xxxxx solutions xx xxx Xxxxxxx Transaction Xxxxx must xx xxxxx xx a formal xxxx xxxxxxxxxx, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx controls xxx xxx xxxxxxxxxxx clauses xxxxxxx to the xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx are xxxx, xx xx xxxxxxxxxx that the xxxxxxxxxxx xxxxx xx xxx xxxxxxx system xx the xxxxxxx xxx xx the xxxxxxxxx xxxxxxx. All xx-xxxxxxxx xxxxxxxxxx of xxx xxxxxx xxxxxxxxx xxxx xx segregated xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx continuity xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx continuity xxxxxxxxxx. Each XXXXXX2 xxxxxxxxxxx xxxxxxxxxx by xxx Eurosystem xx xxxxx xxxxxxxx xxx xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx shall xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx developed xxx xxxxxxxxxx xxx xxxxxxxxxxx them are xx place.
Requirement 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx xxxx xxxxx be xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx profile xx the xxxxxxxxx xxxx shall be xxxxxxxxx xxxx that xx the xxxxxxx xxxx, xx xxxxx xx xxxxx xxxx xxxx sites xxx xxxxxxxx xx xxx xxxx xxxxx xx xxx xxxx time. Xxx example, the xxxxxxxxx xxxx shall xx xx a different xxxxx grid and xxxxxxx telecommunication xxxxxxx xxxx xxxxx of xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx rendering xxx primary xxxx xxxxxxxxxxxx and/or xxxxxxxx xxxxx xxxxxxxxxxx, the xxxxxxxx xxxxxxxxxxx shall xx xxxx to xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx xx xxxxx xx xxxxxxxx xx properly xxxxx xxx business xxx xxx open xxx xxxxxxxxx business xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx be xx place to xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx resumed xxxx xxx xxxxxxxxx site xxxxxx a reasonable timeframe xxxxx xxx xxxxxxx xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxx xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx cope xxxx operational disruptions xxxxx xx xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx period between xxxxx xxxxx not xxxxxx xxx xxxx.