Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx xxxx xxxxxxxxxxx, xxxxxx xxx participant xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx xx xx. Xx xxxxxxxxxxxx xxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx infrastructure, xxx participant xxxxxx xxxxxxxx xxx elements xxxx are part xx xxx Payment Xxxxxxxxxxx Xxxxx (PTC). Xxxxxxxxxxxx, xxx XXX xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx xxxxxxxx xx transactions (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx applications, xxxxxxxxxx), xxx xxxx at xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx xx SWIFT (x.x. SWIFT VPN Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx management xxxxx xxx x&xxxx;xxxxx xxxxxx direction xx xxxx xxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx and xxxxxxxxxx to xxxxxxxxxxx xxxxxxxx through the xxxxxxxx, approval xxx xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx and xxxxx resilience xxxxxx xxx organisation in xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx treatment xx information security xxx xxxxx resilience xxxxx. The policy xxxxxx xxxxxxx xx xxxxx the following xxxxxxxx: objectives, xxxxx (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), principles xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx established xx xxxxxxxxx the xxxxxxxxxxx security xxxxxx xxxxxx xxx organisation. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx and xxxxxx xxx establishment xx xxx information xxxxxxxx xxxxxxxxx xx xxxxxx xxx implementation of xxx information xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx organisation, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx xx xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx reduced xx xxx xxxxxxxxxxxx xx, xxx/xx the xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx or xxxxxxxx/xxxxxxxx xxxxxxxx by them. Xxx xxxxxx xx xxx organisation’s xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx xxxxxxx xxxxx xx controlled. When xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx xxx xxxxxxxx xx access the xxxxxxxxxxxx’x information processing xxxxxxxxxx, a risk xxxxxxxxxx xxxxx xx xxxxxxx xxx to xxxxxxxxx xxx security xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx be xxxxxx xxx xxxxxxx xx xx agreement xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx management

All xxxxxxxxxxx xxxxxx, the business xxxxxxxxx xxx the xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx as operating xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, off-the-shelf xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxx xxxxx of xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx owner. Xxx xxxxxxxxxxxxxx for xxx xxxxxxxxxxx and xxx xxxxxxxxx xx appropriate xxxxxxxx xx xxx xxxxxxxx processes xxx xxx xxxxxxx XX xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxx. Xxxx: xxx xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx specific xxxxxxxx xx xxxxxxxxxxx, xxx remains xxxxxxxxxxx xxx the xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx classification

Information assets xxxxx xx xxxxxxxxxx xx xxxxx xx xxxxx xxxxxxxxxxx xx xxx xxxxxx xxxxxxxx xx xxx service xx xxx participant. Xxx classification xxxxx xxxxxxxx the xxxx, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx in xxx xxxxxxxx business xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx underlying XX components. An xxxxxxxxxxx asset xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx an xxxxxxxxxxx xxx xx protection xxxxxxxx throughout the xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx xxx xxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx addressed xxxxx xx xxxxxxxxxx xx xxxxxxxx job xxxxxxxxxxxx and xx xxxxx xxx xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx and third xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx third party xxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xx xxxxx xxxxxxxx xxxxx xxx responsibilities. Xx adequate level xx awareness xxxxx xx xxxxxxx among xxx employees, xxxxxxxxxxx xxx third party xxxxx, and education xxx xxxxxxxx xx xxxxxxxx procedures and xxx correct xxx xx xxxxxxxxxxx processing xxxxxxxxxx shall be xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security breaches xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be in xxxxx xx ensure xxxx an employee’s, xxxxxxxxxx’x xx third xxxxx xxxx’x exit xxxx xx transfer xxxxxx xxx organisation xx managed, and xxxx the xxxxxx xx xxx xxxxxxxxx xxx xxx removal xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx or xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx in xxxxxx xxxxx, xxxxxxxxx xx xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx appropriate security xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx shall xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx scope xx Requirement 1.6. Xxxxxxxxxx xxx standards xxxxx be xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx information xxxxxx xxxx in xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) xxx xxxxxxx xxx removal of xxxxxxxx xx xxxxxxxxx xx reduce the xxxx of xxxxxxxxxxxx xxxxxx to information xxx xx xxxxx xxxxxxx loss xx xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Special xxxxxxxx xxx xx xxxxxxxx xx protect xxxxxxx xxxxxxxx threats xxx to safeguard xxxxxxxxxx xxxxxxxxxx such xx xxx xxxxxxxxxx xxxxxx xxx cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx and procedures xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx systems xx xxx Payment Transaction Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx of XX xxxxxxx, xxxxxxxxxxx xx duties shall xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, to reduce xxx xxxx xx xxxxxxxxx xx deliberate xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx duties xxxxxx xx implemented xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, compensatory xxxxxxxx shall be xxxxxxxxxxx following x&xxxx;xxxxxx xxxx analysis. Controls xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxxxxx the xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx also xxxxxxxxxxx (xxxxxxxxx xxxx awareness) xx prevent, xxxxxx xxx xxxxxx malicious xxxx. Mobile xxxx xxxxx xx used xxxx xxxx xxxxxxx xxxxxxx (e.g. signed Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx and xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx shall xxxxxxx a plan xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular intervals xx least xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx xxx xxxxxxxx xx payments xxxxx xx xxxxxxxxx and xxxxxx relevant to xxxxxxxxxxx security xxxxx xx xxxxxxxx. Xxxxxxxx xxxx shall xx xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx logs shall xx regularly reviewed xx x&xxxx;xxxxxx xxxxx, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx xx controls xxxxx xxx xxxxxxxxxx xx critical xxx xxx security xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx xxxxxx policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations xxxxx xx xxxxx xx x&xxxx;xxxxxx exchange policy, xxxxxxx xxx in xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx any relevant xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx information xxxx XXXXXX2 (like software xxxxxxxx xxxx a Service Xxxxxx xx scenario 2 xx xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx with xxx xxxxx party.

Requirement 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx established xxxxxxxxx of corporate xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx security policy). Xxxxx access xxxxxxx xxxxx shall be xxxxxxx xxxxx xx xxx xxxxxxxxx xx xxxxx privilege (2) to xxxxxxx xxxxxxx the xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Where xxxxxxxx (x.x. for xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx access xxxxxxx xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx controls xx xxxxx (e.g. xxxxxxxxxx, personal xxxx xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx shall xx xx xxxxx xx xxxxxxx the allocation xx access xxxxxx xx xxxxxxxxxxx xxxxxxx xxx xxxxxxxx that xxxx within xxx xxxxx xx xxx Xxxxxxx Transaction Chain. Xxx xxxxxxxxxx shall xxxxx xxx xxxxxx xx the lifecycle xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx of xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx xx xxxxxx require access.

Special xxxxxxxxx shall xx xxxxx, where appropriate, xx the xxxxxxxxxx xx xxxxxx rights xx such xxxxxxxxxxx xxxx xxx xxxxx xx those access xxxxxx xxxxx xxxx xx a severe xxxxxxx xxxxxx xx xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (e.g. access xxxxxx allowing system xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, direct xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx xx specific xxxxxx xx the xxxxxxxxxxxx’x network, x.x. xxx xxxxx and xxxxxx access xx xxxxxxx in the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx shall xxx xx shared xx order xx xxxxxx accountability.

For xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx xxx enforced xx xxxxxxxx xxxxxxxx xx xxxxxx that xxxxxxxxx xxxxxx be xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx and xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx integrity of xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx xx xxxxxxxxxxx xx support xxx xxx of xxxxxxxxxxxxx controls.

There xxxxx xx policy xxx xxxxxxx confidential information xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx xxx risk xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx xx working xx an xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx appropriate xxxxxxxxx xxx organisational xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxx prior xx the development xxx/xx implementation xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx built xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx correct processing. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx processing xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx xxx xxxxxxx xxxx process, xx xxxx xx xxxxxx xx, xxxxxxxxx, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx controls shall xx xxxxxxxxxx xx xxx xxxxx xx xxxxxxxx requirements xxx xxxx assessment according xx xxx established xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx policy).

The xxxxxxxxxxx xxxxxxxxxxxx xx new xxxxxxx xxxxx xx xxxxxxxxxxx, documented and xxxxxx prior to xxxxx xxxxxxxxxx and xxx. As regards xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx xx implemented xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx and the xxxxx xx risk xx xxx xxxxxxx xxxxx in xxx xxxxxxxxxxxx. There xxxxx xx specific xxxxxxxx xx protect sensitive xxxxxxxxxxx passing xxxx xxxxxx networks.

Access xx xxxxxx files and xxxxxxx xxxxxx code xxxxx be xxxxxxxxxx xxx XX projects xxx support xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx taken xx xxxxx xxxxxxxx of xxxxxxxxx data in xxxx environments. Project xxx support xxxxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx xxx xxxxx xxxxxxx to xx xxxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx systems xx xxxxxxxxxx shall also xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx plan xxxxx xx the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx shall include, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xxx xxxxxx xxxxx to xxxxx xxx xxxxxxxxxx xxx shall xx xxxxxxxx xxx followed xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx ensure protection xx xxx xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems xxxx xxx xxxxxxxxxx xx suppliers, xxxxxxxxxxx xxxxxxxx requirements xxx xxxxxxxxxx the xxxxx xxxxxxxxxx with xxxxxxxx’x xxxxxx xxxxx be xxxxxxxxxx xxx formally xxxxxx xxxx with xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx effective approach xx the management xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, including communication xx security events xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, effective and xxxxxxx and xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx including xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx pursued by xx external xxxxxxxx xx xx xx xxxxxxx). Personnel xxxxxxxx xx xxxxx procedures xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx connectivity) xxxxx xx xxxxxxxxx xxxxxxxx xxx compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx xxxxxx xxxx xxx the xxxxxxxx xxxxxxxx that xxx xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. hardening, xxxxxxx). Xxxxxxxx relating to xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx of xxx xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx system, xxxxxxx patching, strict xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. production xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx as well xx xxxxxxxx xx xxxxxx xxxxxx, in xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx xxxxx xx x&xxxx;xxxx assessment. Xxxxx virtual xxxxxxxx xxxxxxx by the xxxx xxxxxxxxxx shall xxxx x&xxxx;xxxxxxx risk xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx and/or xxxxxx xxxxx solutions xx xxx Payment Xxxxxxxxxxx Xxxxx xxxx be xxxxx on x&xxxx;xxxxxx xxxx assessment, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx the xxxxx solution.

If hybrid xxxxx solutions are xxxx, it xx xxxxxxxxxx xxxx the xxxxxxxxxxx xxxxx of xxx overall system xx xxx xxxxxxx xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (applicable xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx requirements (2.1 xx 2.6) relate xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Each XXXXXX2 xxxxxxxxxxx xxxxxxxxxx xx xxx Eurosystem xx xxxxx critical xxx xxx xxxxxx xxxxxxxxxxx xx xxx XXXXXX2 xxxxxx xxxxx have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx place xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx developed xxx procedures for xxxxxxxxxxx them are xx place.
Requirement 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx xxxx xxxxx xx available.
Requirement 2.3	:	Xxx xxxx xxxxxxx xx xxx alternate xxxx xxxxx xx xxxxxxxxx xxxx that xx the xxxxxxx xxxx, in xxxxx xx xxxxx that xxxx xxxxx are xxxxxxxx xx the xxxx event xx xxx xxxx xxxx. Xxx xxxxxxx, the xxxxxxxxx xxxx shall xx on x&xxxx;xxxxxxxxx xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx xx a major xxxxxxxxxxx disruption rendering xxx primary xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx the xxxxxxxxx xxxx, xxxxx xx xxxxx be xxxxxxxx xx xxxxxxxx close xxx xxxxxxxx day xxx xxxx xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall be xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx xx transactions xx xxxxxxx xxxx xxx alternate site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx initial xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx to xxx criticality of xxx xxxxxxxx xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	The xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx least xxxx x&xxxx;xxxx xxx critical xxxxx xxxxx xx xxxxxxxxxxxxx trained. Xxx xxxxxxx xxxxxx between xxxxx xxxxx xxx xxxxxx xxx year.