Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx xxxxxxxx management xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx xxxx participant, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx xx xxx xxxxxxxxxx to it. Xx xxxxxxxxxxxx xxx xxxxx of xxxxxxxxxxx xx xxx requirements xxxxxx xxx xxxxxxxxxxxxxx, xxx participant should xxxxxxxx xxx xxxxxxxx xxxx are xxxx xx xxx Payment Xxxxxxxxxxx Xxxxx (PTC). Xxxxxxxxxxxx, the PTC xxxxxx at x&xxxx;Xxxxx xx Entry (PoE), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, middleware), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx send xxx xxxxxxx xx XXXXX (x.x. XXXXX VPN Xxx) xx Xxxxxxxx (xxxx xxx latter xxxxxxxxxx to Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx policy

The management xxxxx xxx x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx xxxx xxxxxxxx xxxxxxxxxx and demonstrate xxxxxxx xxx xxx xxxxxxxxxx xx information xxxxxxxx xxxxxxx xxx xxxxxxxx, approval and xxxxxxxxxxx xx an xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx across xxx xxxxxxxxxxxx in xxxxx xx identification, xxxxxxxxxx and xxxxxxxxx xx information xxxxxxxx xxx xxxxx resilience xxxxx. Xxx xxxxxx xxxxxx xxxxxxx at xxxxx the xxxxxxxxx xxxxxxxx: objectives, scope (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), xxxxxxxxxx and xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx established xx xxxxxxxxx the xxxxxxxxxxx xxxxxxxx policy xxxxxx xxx xxxxxxxxxxxx. Xxx management xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx implementation xx xxx information xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx resources and xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x information xxx xxxxxxxxxxx processing xxxxxxxxxx should not xx xxxxxxx xx xxx xxxxxxxxxxxx xx, xxx/xx xxx xxxxxxxxxx xx, an external xxxxx/xxxxxxx xx products/services xxxxxxxx xx xxxx. Xxx access xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties xxxxx xx controlled. Xxxx xxxxxxxx xxxxxxx or xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx are xxxxxxxx xx access the xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx xx xxxxxxxxx xxx xxxxxxxx xxxxxxxxxxxx xxx control xxxxxxxxxxxx. Xxxxxxxx shall xx xxxxxx xxx xxxxxxx xx xx xxxxxxxxx xxxx each xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx and xxx xxxxxxxxxx information xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx accounted xxx xxx have x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx for the xxxxxxxxxxx xxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx processes xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx be assigned. Xxxx: the xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx specific xxxxxxxx xx xxxxxxxxxxx, xxx remains xxxxxxxxxxx xxx the proper xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxx xx xxxxx of xxxxx xxxxxxxxxxx xx xxx xxxxxx delivery xx the xxxxxxx xx xxx participant. Xxx classification shall xxxxxxxx xxx need, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx required xxxx handling the xxxxxxxxxxx xxxxx in xxx relevant xxxxxxxx xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX components. An xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx approved xx xxx management shall xx xxxx to xxxxxx an xxxxxxxxxxx xxx of protection xxxxxxxx throughout xxx xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx and xxxxxxxxxxx of information xxxxxx) xxx xx xxxxxxxxxxx the need xxx specific xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx responsibilities xxxxx xx xxxxxxxxx xxxxx to xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx and in xxxxx and xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx xxx third xxxxx xxxxx shall xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xx their xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx ensured among xxx employees, xxxxxxxxxxx xxx third party xxxxx, xxx xxxxxxxxx xxx training in xxxxxxxx procedures and xxx correct use xx information processing xxxxxxxxxx shall xx xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx breaches xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx to xxxxxx xxxx xx employee’s, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx or xxxxxxxx xxxxxx the xxxxxxxxxxxx xx managed, xxx xxxx xxx xxxxxx xx xxx equipment xxx xxx removal xx xxx xxxxxx xxxxxx are xxxxxxxxx.

Xxxxxxxxxxx 1.7: Physical xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx in secure xxxxx, xxxxxxxxx xx xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx entry xxxxxxxx. They xxxxx xx physically xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx who xxxx xxxxxx the xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx and standards xxxxx be xxxxxxxxxxx xx protect xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx when xx xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of equipment (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) and against xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx xxxxxx the xxxx xx unauthorised xxxxxx xx xxxxxxxxxxx xxx xx guard xxxxxxx loss xx xxxxxx xx xxxxxxxxx xx information. Xxxxxxx xxxxxxxx xxx be xxxxxxxx xx xxxxxxx xxxxxxx physical xxxxxxx xxx to safeguard xxxxxxxxxx xxxxxxxxxx such xx xxx xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxx xxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxxxx facilities xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx end-to-end.

As regards xxxxxxxxx procedures, including xxxxxxxxx xxxxxxxxxxxxxx of XX xxxxxxx, xxxxxxxxxxx xx duties xxxxx xx implemented, xxxxx xxxxxxxxxxx, to xxxxxx xxx xxxx xx xxxxxxxxx or xxxxxxxxxx xxxxxx misuse. Xxxxx xxxxxxxxxxx of xxxxxx xxxxxx xx implemented xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx be xxxxxxxxxxx xx prevent xxx xxxxxx the xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx xxxx established (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, xxxxxx xxx remove malicious xxxx. Xxxxxx code xxxxx xx used xxxx xxxx xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (x.x. xxx use xx xxxxxxxxxx xxx xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx backup and xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxx management; xxxxx xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx of xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular xxxxxxxxx xx least xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx shall xx monitored xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx security shall xx xxxxxxxx. Xxxxxxxx xxxx shall be xxxx xx ensure xxxx information xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx logs shall xx regularly reviewed xx a sample xxxxx, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx be xxxx xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx are xxxxxxxxxx xx xxxxxxxx for xxx xxxxxxxx xx xxxxxxxx xxx xx xxxxxx conformity to xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx of information xxxxxxx xxxxxxxxxxxxx xxxxx xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx xx xxxx xxxx exchange xxxxxxxxxx xxxxx xxx xxxxxxxx parties xxx xxxxx xx xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (xxxx xxxxxxxx xxxxxxxx xxxx a Service Xxxxxx in xxxxxxxx 2 of xxx xxxxx section xx xxx XXXXXX2 self-certification xxxxxxxxxxx document) must xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx xxx basis xx xxxxxxxx requirements (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx established xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx security xxxxxx). Xxxxx xxxxxx control xxxxx shall be xxxxxxx xxxxx xx xxx xxxxxxxxx of xxxxx privilege (2) xx xxxxxxx xxxxxxx xxx xxxxx of xxx xxxxxxxxxxxxx xxxxxxxx and XX xxxxxxxxx. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) logical xxxxxx control xxxxxx xx consistent with xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx xxx xxxxxxxx compensatory controls xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx be xx xxxxx to xxxxxxx the allocation xx xxxxxx rights xx xxxxxxxxxxx systems xxx xxxxxxxx that xxxx within xxx xxxxx of the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx xxxxxx xx the lifecycle xx xxxx access, xxxx the xxxxxxx xxxxxxxxxxxx xx new xxxxx to the xxxxx xxxxxxxxxxxxxx of xxxxx that no xxxxxx xxxxxxx xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx xx xxxxx, where appropriate, xx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx abuse xx xxxxx access xxxxxx could xxxx xx a severe xxxxxxx xxxxxx xx xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, override of xxxxxx controls, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx shall xx xxx in xxxxx xx identify, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local and xxxxxx access to xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx xxxxx to xxxxxx xxxxxxxxxxxxxx.

Xxx passwords, xxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxx xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx rules xxx xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx recovery xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx developed and xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx to protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxxx to xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx screen, a clear xxxx policy) xx xxxxxx xxx xxxx xx unauthorised xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx of xxxxxxx xx xx unprotected xxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx and xxxxxxxxxxxxxx xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxx prior xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx systems.

Appropriate xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx applications, to xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx controls xxxxx xxxxxxx xxx validation xx xxxxx xxxx, xxxxxxxx processing and xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx xxx systems xxxx xxxxxxx, xx xxxx an impact xx, xxxxxxxxx, valuable xx critical xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx xxx xxxx assessment xxxxxxxxx xx the established xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

The operational xxxxxxxxxxxx of new xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx and xxxxxx prior xx xxxxx xxxxxxxxxx xxx xxx. As xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, including xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx xxx the xxxxx xx risk xx xxx xxxxxxx xxxxx in xxx xxxxxxxxxxxx. There shall xx specific xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx passing over xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx and xxxxxxx xxxxxx xxxx xxxxx be controlled xxx IT projects xxx xxxxxxx activities xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Care xxxxx xx xxxxx xx xxxxx xxxxxxxx xx xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx support xxxxxxxxxxxx xxxxx be strictly xxxxxxxxxx. Deployment of xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx xxx xxxxx xxxxxxx to be xxxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx xx the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. All of xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx the xxxxxxxx xxxxxxx activities shall xx xxxxxxxx and xxxxxx plans xx xxxxx any xxxxxxxxxx xxx xxxxx xx xxxxxxxx and xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx ensure protection xx the xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx are xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx supplier’s xxxxxx shall xx xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx ensure x&xxxx;xxxxxxxxxx xxx xxxxxxxxx approach xx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx business xxx xxxxxxxxx xxxxx, xxxxx xx established xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, effective xxx xxxxxxx and safely xxxxxxx from information xxxxxxxx incidents xxxxxxxxx xxxxxxxxx xxxxxxx to x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx xxxxxxx xx xx external xxxxxxxx xx xx xx xxxxxxx). Personnel xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx review

A participant’s internal xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx xxx xxxxxxxxxx xxxx the xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (x.x. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx xxx security xxxxxxxx xxxx xxx xxx xxx physical xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx and xxx xxxxxxx xxxxxxxxx system, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Centralised xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx xxxxxxxx xx xxxxxx xxxxxx, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx accounts, xxxxx xx implemented xxxxx xx a risk xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx hypervisor shall xxxx a similar xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx of xxxxxx and/or hybrid xxxxx xxxxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx xx xxxxx xx x&xxxx;xxxxxx xxxx assessment, xxxxxx xxxx account xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions are xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx xxxxx xx xxx xxxxxxx system xx the highest xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx solutions xxxx xx segregated xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx continuity xxxxxxxxxx (xxxxxxxxxx xxxx xx critical participants)

The xxxxxxxxx requirements (2.1 xx 2.6) xxxxxx xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx by xxx Xxxxxxxxxx xx xxxxx xxxxxxxx xxx xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx place comprising xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx continuity xxxxx xxxxx be xxxxxxxxx xxx xxxxxxxxxx for xxxxxxxxxxx them xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx xxxxxxx xx the xxxxxxxxx xxxx xxxxx be xxxxxxxxx from that xx the xxxxxxx xxxx, xx order xx xxxxx that xxxx sites xxx xxxxxxxx xx the xxxx event at xxx xxxx xxxx. Xxx example, xxx xxxxxxxxx xxxx xxxxx xx on x&xxxx;xxxxxxxxx xxxxx grid xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx of x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary xxxx xxxxxxxxxxxx xxx/xx critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx participant xxxxx xx xxxx xx xxxxxx xxxxxx operations xxxx xxx alternate xxxx, xxxxx xx xxxxx be xxxxxxxx xx properly xxxxx xxx xxxxxxxx xxx xxx open xxx xxxxxxxxx business xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall xx xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx xxxxxxx from xxx alternate site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx the xxxxxxx xxxxxxxxxx xx xxxxxxx xxx commensurate xx xxx xxxxxxxxxxx of xxx business that xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx to xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx be xxxxxx xx xxxxx once x&xxxx;xxxx xxx critical xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx period xxxxxxx xxxxx xxxxx not xxxxxx one xxxx.