Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx security xxxxxxxxxx xxx business continuity xxxxxxxxxx

Xxxxxxxxxxx security management

These xxxxxxxxxxxx are applicable xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx xx xx. Xx xxxxxxxxxxxx xxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx xxx part xx the Payment Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx a Point xx Entry (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx applications, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx responsible xx xxxx xxx xxxxxxx xx SWIFT (x.x. SWIFT XXX Xxx) xx Xxxxxxxx (xxxx xxx latter xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx xxx a clear xxxxxx xxxxxxxxx in xxxx with xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx to xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx xx xx xxxxxxxxxxx security xxxxxx xxxxxx at xxxxxxxx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx across xxx organisation xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx information xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. Xxx xxxxxx xxxxxx xxxxxxx xx xxxxx xxx following xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx organisation, xxxxx xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx and xxxxxxxxxx of responsibilities.

Requirement 1.2: Internal xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxxxx the xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx organisation. Xxx xxxxxxxxxx shall xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to ensure xxx implementation xx xxx information xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxx xxxxxxxxxxxxxxxx for this xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx introduction xx, xxx/xx xxx dependence xx, an xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx xxxxxx xx xxx organisation’s xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx or xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx xxx xxxxxxxx xx access xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx to xxxxxxxxx xxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxx requirements. Xxxxxxxx shall xx xxxxxx xxx defined xx an xxxxxxxxx xxxx xxxx xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, the xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, business xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx xx xxx Xxxxxxx Transaction Xxxxx xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx and xxx xxxxxxxxx of appropriate xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxx. Xxxx: xxx xxxxx xxx xxxxxxxx the xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of the xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx classification

Information xxxxxx xxxxx xx xxxxxxxxxx xx xxxxx xx xxxxx criticality xx xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx xxx participant. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx degree xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx the xxxxxxxxxxx asset in xxx relevant business xxxxxxxxx xxx xxxxx xxxx xxxx into xxxxxxxxxxxxx the underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx asset xxxxxxxxxxxxxx xxxxxx xxxxxxxx by xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxx throughout the xxxxxxxxxxx asset lifecycle (xxxxxxxxx xxxxxxx and xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) and xx xxxxxxxxxxx the xxxx xxx xxxxxxxx handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx be xxxxxxxxx xxxxx to xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx xxx xx xxxxx xxx xxxxxxxxxx xx xxxxxxxxxx. All xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx xxxxx xx adequately xxxxxxxx, xxxxxxxxxx for sensitive xxxx. Employees, xxxxxxxxxxx xxx third party xxxxx of information xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xx their xxxxxxxx xxxxx xxx responsibilities. Xx xxxxxxxx level xx xxxxxxxxx shall xx xxxxxxx xxxxx xxx xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, and education xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx xxx xxx xxxxxxx xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx be xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx established xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx xx xxxxxx xxxx an xxxxxxxx’x, xxxxxxxxxx’x or xxxxx xxxxx xxxx’x xxxx xxxx xx xxxxxxxx xxxxxx the xxxxxxxxxxxx xx xxxxxxx, xxx xxxx xxx xxxxxx xx xxx equipment xxx xxx removal xx xxx access xxxxxx xxx completed.

Requirement 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx or xxxxxxxxx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx xx secure xxxxx, xxxxxxxxx xx xxxxxxx security xxxxxxxxxx, xxxx appropriate security xxxxxxxx and entry xxxxxxxx. Xxxx xxxxx xx physically xxxxxxxxx xxxx unauthorised access, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx shall xx xxxxxxx only xx xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx established xx protect physical xxxxx xxxxxxxxxx information xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx xxxxxxxx xxx environmental xxxxxxx. Xxxxxxxxxx of equipment (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx xxxxxx the xxxx of xxxxxxxxxxxx xxxxxx xx information xxx xx xxxxx xxxxxxx xxxx xx xxxxxx xx equipment xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx to xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx xx xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx the xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx established xxx the management xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx all xxx xxxxxxxxxx xxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx administration xx XX xxxxxxx, segregation xx xxxxxx xxxxx xx xxxxxxxxxxx, where xxxxxxxxxxx, to xxxxxx xxx risk xx xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx be established xx xxxxxxx xxx xxxxxx the xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx systems xx xxx Xxxxxxx Transaction Xxxxx. Controls xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, detect xxx xxxxxx malicious xxxx. Xxxxxx xxxx xxxxx be xxxx xxxx xxxx xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (e.g. xxx xxx xx xxxxxxxxxx and plugins) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx backup and xxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx a plan of xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular intervals xx xxxxx xxxxxxxx.

Xxxxxxx xxxx are xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx xxxxx xx xxxxxxxxx xxx xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx xxxxx xx recorded. Operator xxxx shall xx xxxx to xxxxxx xxxx information xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx logs xxxxx xx regularly xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx be xxxx xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx xxx identified xx xxxxxxxx for xxx xxxxxxxx xx xxxxxxxx xxx to xxxxxx conformity xx xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx xxxxx xx xxxxx on x&xxxx;xxxxxx exchange xxxxxx, xxxxxxx xxx xx xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx xxxxxxx xxx xxxxx xx compliant xxxx xxx relevant xxxxxxxxxxx. Xxxxx party xxxxxxxx components xxxxxxxx xx the exchange xx xxxxxxxxxxx xxxx XXXXXX2 (like software xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx in xxxxxxxx 2 xx xxx xxxxx section of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx information xxxxxx xxxxx be xxxxxxxxx xx xxx basis xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx according xx xxx xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx the xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx xxxxxxx xxxxx shall xx xxxxxxx xxxxx xx xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx xxx xxxxx xx the xxxxxxxxxxxxx business and XX xxxxxxxxx. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) logical xxxxxx control should xx xxxxxxxxxx xxxx xxxxxxxx access xxxxxxx xxxxxx xxxxx xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx place (e.g. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx shall be xx place xx xxxxxxx the xxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxxxxxx xxx xxxxxxxx that xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Transaction Xxxxx. Xxx xxxxxxxxxx shall xxxxx xxx stages xx the xxxxxxxxx xx user xxxxxx, xxxx the initial xxxxxxxxxxxx of xxx xxxxx xx the xxxxx deregistration xx xxxxx that xx xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx be xxxxx, where xxxxxxxxxxx, xx xxx allocation xx access rights xx xxxx criticality xxxx xxx xxxxx xx xxxxx access xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx xxxxxxx xxxxxx on xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, xxxxxxxx of xxxxxx xxxxxxxx, xxxxxx xxxxxx to business xxxx).

Xxxxxxxxxxx controls xxxxx xx xxx in xxxxx xx xxxxxxxx, xxxxxxxxxxxx and authorise xxxxx xx xxxxxxxx xxxxxx in the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local and xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Transaction Chain. Xxxxxxxx xxxxxxxx xxxxx xxx be xxxxxx xx order xx xxxxxx accountability.

For passwords, xxxxx shall be xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx controls xx ensure xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx xxxxxxxx and/or xxxxx protocol shall xx established.

A policy xxxxx xx xxxxxxxxx and xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx xx xxxxxxx xxx confidentiality, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxx of xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx confidential xxxxxxxxxxx xx screen or xx xxxxx (x.x. x&xxxx;xxxxx screen, x&xxxx;xxxxx xxxx xxxxxx) to xxxxxx xxx xxxx xx unauthorised access.

When xxxxxxx xxxxxxxx, xxx xxxxx xx working xx xx unprotected xxxxxxxxxxx xxxxx be xxxxxxxxxx and appropriate xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxx xxxxx xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx built xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx correct xxxxxxxxxx. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx processing xxx xxxxxx data. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx process, xx xxxx an xxxxxx xx, xxxxxxxxx, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx controls xxxxx xx determined xx xxx xxxxx xx xxxxxxxx requirements and xxxx assessment xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

The xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx shall xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx prior to xxxxx xxxxxxxxxx and xxx. Xx xxxxxxx xxxxxxx security, appropriate xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx secure xxxxxxxxxx, xxxxxx xx implemented xxxxx on xxx xxxxxxxxxxx xx data xxxxx and xxx xxxxx xx xxxx xx the xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx shall xx xxxxxxxx xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx passing xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx files xxx xxxxxxx xxxxxx xxxx xxxxx be xxxxxxxxxx xxx XX xxxxxxxx xxx support xxxxxxxxxx xxxxxxxxx in a secure xxxxxx. Care xxxxx xx xxxxx xx xxxxx exposure xx xxxxxxxxx xxxx xx xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx the xxxxx xxxxxxx to xx xxxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx security xxxxxxx activities shall xx assessed xxx xxxxxx xxxxx to xxxxx xxx xxxxxxxxxx xxx xxxxx be xxxxxxxx and followed xx in x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems xxxx xxx xxxxxxxxxx xx xxxxxxxxx, information xxxxxxxx requirements xxx xxxxxxxxxx the xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx xx xxxxxxxxxx and formally xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx a consistent xxx effective approach xx xxx management xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx and xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx established and xxxxxx to xxxxxx x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx xxx safely xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx incidents xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (e.g. x&xxxx;xxxxx xxxxxxx by xx xxxxxxxx xxxxxxxx xx by an xxxxxxx). Personnel involved xx xxxxx xxxxxxxxxx xxxxx be xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx (e.g. xxxx xxxxxx xxxxxxx, xxxxxxxx networks xxx xxxxxxxx network xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx for xxxxxxxxxx xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx systems (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx patching, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (e.g. xxxxxxxxxx xxx xxxxxxxxxxx). Centralised xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx managing xx xxxxxx xxxxxx, xx xxxxxxxxxx for high xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx based xx a risk xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx by the xxxx xxxxxxxxxx shall xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx xxxxxx xxxxx xxxxxxxxx in xxx Xxxxxxx Transaction Xxxxx xxxx be xxxxx on a formal xxxx xxxxxxxxxx, taking xxxx xxxxxxx xxx xxxxxxxxx controls and xxx contractual xxxxxxx xxxxxxx xx the xxxxx xxxxxxxx.

Xx xxxxxx xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx level of xxx xxxxxxx xxxxxx xx the xxxxxxx xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx hybrid xxxxxxxxx xxxx xx segregated xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx continuity xxxxxxxxxx (xxxxxxxxxx only xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx business continuity xxxxxxxxxx. Each TARGET2 xxxxxxxxxxx classified by xxx Xxxxxxxxxx as xxxxx critical xxx xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx xxxxx have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx continuity xxxxx xxxxx be xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx them xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx risk xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx be xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, in xxxxx xx xxxxx xxxx xxxx xxxxx xxx xxxxxxxx by xxx xxxx xxxxx xx xxx xxxx xxxx. Xxx example, the xxxxxxxxx site xxxxx xx on x&xxxx;xxxxxxxxx xxxxx grid xxx xxxxxxx telecommunication xxxxxxx xxxx xxxxx xx xxx xxxxxxx business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, the xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, where it xxxxx xx xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx xxx xxx open xxx xxxxxxxxx xxxxxxxx day(s).
Requirement 2.5	:	Xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx xxxx xxxxxx a reasonable timeframe xxxxx the xxxxxxx xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxx xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx cope xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx be xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx critical xxxxx xxxxx be xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx between xxxxx xxxxx xxx xxxxxx xxx xxxx.