Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx management xxx xxxxxxxx continuity xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx are applicable xx xxxx participant, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx xx xxx xxxxxxxxxx xx xx. Xx establishing the xxxxx xx xxxxxxxxxxx xx xxx requirements xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxx xxxx are part xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx involved xx xxx creation xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx at xxx xxxxxx responsible xx send the xxxxxxx xx SWIFT (x.x. XXXXX XXX Xxx) xx Internet (xxxx xxx xxxxxx xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx policy

The xxxxxxxxxx xxxxx xxx x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx xxxx business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx to information xxxxxxxx through xxx xxxxxxxx, approval xxx xxxxxxxxxxx of xx xxxxxxxxxxx security policy xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx and xxxxx xxxxxxxxxx across xxx xxxxxxxxxxxx xx xxxxx xx identification, xxxxxxxxxx xxx treatment xx information security xxx cyber resilience xxxxx. Xxx xxxxxx xxxxxx xxxxxxx xx xxxxx the xxxxxxxxx xxxxxxxx: xxxxxxxxxx, scope (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx xxx xxxxxxxxxx of responsibilities.

Requirement 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx security xxxxxxxxx xxxxx be established xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy xxxxxx xxx xxxxxxxxxxxx. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx review xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to ensure xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx per Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx resources and xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx of xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx should xxx xx xxxxxxx by xxx xxxxxxxxxxxx of, xxx/xx xxx dependence xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx by xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x information xxxxxxxxxx xxxxxxxxxx by xxxxxxxx parties shall xx xxxxxxxxxx. Xxxx xxxxxxxx parties xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx xx xxxxxxx xxx xx xxxxxxxxx xxx security xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx shall xx xxxxxx xxx xxxxxxx xx xx agreement xxxx xxxx relevant xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, xxx business xxxxxxxxx xxx xxx xxxxxxxxxx information systems, xxxx xx xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, business xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx the xxxxx xx xxx Xxxxxxx Transaction Xxxxx xxxxx be xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx the xxxxxxxxxxx xxx the xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx processes and xxx related IT xxxxxxxxxx to xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxx. Xxxx: xxx xxxxx xxx delegate the xxxxxxxxxxxxxx xx specific xxxxxxxx xx xxxxxxxxxxx, xxx remains xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx xx the xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxx xx terms xx xxxxx criticality to xxx smooth xxxxxxxx xx xxx xxxxxxx xx xxx xxxxxxxxxxx. Xxx classification shall xxxxxxxx xxx need, xxxxxxxxxx xxx degree xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx asset xx xxx relevant xxxxxxxx xxxxxxxxx and xxxxx xxxx take xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX components. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx management xxxxx xx xxxx to xxxxxx xx xxxxxxxxxxx xxx of xxxxxxxxxx xxxxxxxx throughout xxx xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx of xxxxxxxxxxx xxxxxx) and to xxxxxxxxxxx xxx xxxx xxx specific xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx employment xx xxxxxxxx job xxxxxxxxxxxx xxx xx xxxxx xxx conditions xx employment. All xxxxxxxxxx for employment, xxxxxxxxxxx xxx third xxxxx users shall xx adequately xxxxxxxx, xxxxxxxxxx for sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx party xxxxx xx information xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx agreement xx xxxxx security xxxxx xxx xxxxxxxxxxxxxxxx. Xx adequate xxxxx xx xxxxxxxxx shall xx ensured among xxx xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx, xxx xxxxxxxxx xxx xxxxxxxx in xxxxxxxx xxxxxxxxxx xxx xxx correct xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xx xxxx xx xxxxxxxx possible xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx process xxx xxxxxxxx xxxxxxxx breaches xxxxx be xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx xx xx xxxxx to xxxxxx xxxx xx employee’s, xxxxxxxxxx’x xx xxxxx xxxxx user’s exit xxxx xx xxxxxxxx xxxxxx xxx organisation xx xxxxxxx, xxx xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx the removal xx xxx xxxxxx xxxxxx are completed.

Requirement 1.7: Physical and xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx or xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx in xxxxxx xxxxx, protected by xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx who xxxx xxxxxx the xxxxx xx Requirement 1.6. Xxxxxxxxxx and standards xxxxx xx xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx information xxxxxx xxxx in xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) and xxxxxxx xxx removal xx xxxxxxxx xx necessary xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx to information xxx xx guard xxxxxxx loss xx xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx may xx xxxxxxxx to xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx to safeguard xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx be xxxxxxxxxxx xxx xxx xxxxxxxxxx xxx operation of xxxxxxxxxxx processing xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx administration xx XX xxxxxxx, xxxxxxxxxxx xx xxxxxx xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx reduce xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx misuse. Where xxxxxxxxxxx of xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx documented xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx xxxxx be xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx prevent and xxxxxx xxx xxxxxxxxxxxx xx malicious xxxx xxx systems in xxx Payment Xxxxxxxxxxx Xxxxx. Controls xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx prevent, xxxxxx xxx xxxxxx malicious xxxx. Xxxxxx code xxxxx xx used xxxx xxxx xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx configuration xx xxx xxxxxxx (x.x. xxx use of xxxxxxxxxx xxx xxxxxxx) xxxxx be strictly xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx xx xxx management; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx a plan xx xxx restoration xxxxxxx xxxxx xx xxxxxx xx regular intervals xx xxxxx annually.

Systems xxxx are xxxxxxxx xxx the xxxxxxxx xx xxxxxxxx shall xx xxxxxxxxx and xxxxxx xxxxxxxx to xxxxxxxxxxx security shall xx recorded. Operator xxxx shall xx xxxx xx ensure xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on the xxxxxxxxxxx of xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx are identified xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx xxx xx xxxxxx conformity xx xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx xxxxx xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx xx xxxx with xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx components xxxxxxxx xx xxx exchange xx xxxxxxxxxxx xxxx XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 xx the xxxxx section xx xxx TARGET2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx used xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx party.

Requirement 1.9: Access xxxxxxx

Xxxxxx xx information xxxxxx xxxxx xx justified xx xxx xxxxx xx business xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx established xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy). Xxxxx access xxxxxxx xxxxx shall xx xxxxxxx xxxxx xx xxx xxxxxxxxx of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely the xxxxx of xxx xxxxxxxxxxxxx business and XX processes. Where xxxxxxxx (x.x. for xxxxxx management) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx with xxxxxxxx access xxxxxxx xxxxxx there xxx xxxxxxxx compensatory controls xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx be xx place to xxxxxxx the allocation xx access xxxxxx xx information xxxxxxx xxx services that xxxx xxxxxx the xxxxx of xxx Xxxxxxx Xxxxxxxxxxx Chain. Xxx xxxxxxxxxx shall xxxxx xxx stages xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx xx xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx of xxxxx xxxx xx xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx be xxxxx, xxxxx xxxxxxxxxxx, xx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxx criticality xxxx xxx abuse xx xxxxx xxxxxx xxxxxx could xxxx xx x&xxxx;xxxxxx adverse xxxxxx xx xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. access xxxxxx allowing xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, direct xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx controls xxxxx xx xxx xx xxxxx to xxxxxxxx, xxxxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx xxxxx xxx xxxxxx xxxxxx to xxxxxxx in xxx Xxxxxxx Transaction Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx be shared xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx passwords, xxxxx shall xx xxxxxxxxxxx and xxxxxxxx xx xxxxxxxx xxxxxxxx xx ensure that xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx rules and xxxxxxx-xxxx validity. A safe xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx and xxxxxxxxxxx on the xxx of cryptographic xxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx information xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx screen, x&xxxx;xxxxx xxxx policy) to xxxxxx xxx risk xx unauthorised xxxxxx.

Xxxx xxxxxxx remotely, xxx xxxxx of xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx xxx organisational xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, development xxx maintenance

Security requirements xxxxx be identified xxx xxxxxx prior xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx applications, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx xxxxxxxx xxxxx xxxxxxx the xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx may be xxxxxxxx for systems xxxx xxxxxxx, or xxxx an impact xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx on xxx basis of xxxxxxxx xxxxxxxxxxxx xxx xxxx assessment xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx be xxxxxxxxxxx, documented xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx xxx xxx. Xx xxxxxxx xxxxxxx security, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx management, xxxxxx xx implemented xxxxx xx xxx xxxxxxxxxxx of xxxx xxxxx xxx xxx xxxxx xx xxxx xx xxx network xxxxx xx the xxxxxxxxxxxx. Xxxxx shall xx xxxxxxxx xxxxxxxx xx protect sensitive xxxxxxxxxxx xxxxxxx xxxx xxxxxx networks.

Access to xxxxxx files xxx xxxxxxx source xxxx xxxxx xx xxxxxxxxxx xxx IT xxxxxxxx xxx support activities xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx xxxxx xx xxxxx xxxxxxxx of xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx support xxxxxxxxxxxx xxxxx be strictly xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx the xxxxx xxxxxxx xx xx xxxxxxxx xx production xxxxx be xxxxxxxxx.

Xxxxxxx xxxxxxxx testing xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx shall xxxx xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx security xxxxxxx xxxxx include, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx of xxx xxxxxxxxxxxx highlighted xxxxxx xxx security xxxxxxx xxxxxxxxxx xxxxx xx assessed and xxxxxx plans to xxxxx xxx xxxxxxxxxx xxx xxxxx xx xxxxxxxx xxx followed xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx are xxxxxxxxxx xx xxxxxxxxx, information xxxxxxxx requirements for xxxxxxxxxx the risks xxxxxxxxxx with supplier’s xxxxxx xxxxx xx xxxxxxxxxx and formally xxxxxx xxxx with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx approach xx the management xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, including xxxxxxxxxxxxx xx security events xxx weaknesses, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx xxxxx, shall xx xxxxxxxxxxx and xxxxxx to ensure x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx and xxxxxx xxxxxxx xxxx information xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx pursued xx xx xxxxxxxx xxxxxxxx xx xx an xxxxxxx). Personnel involved xx these xxxxxxxxxx xxxxx be adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx systems (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx regularly xxxxxxxx for compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, cryptographic xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx the xxxxxxxx xxxxxxxx xxxx are xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx the xxxxxxxxxx xxx the xxxxxxx operating xxxxxx, xxxxxxx patching, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Centralised xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx xxxxxxxx of xxxxxx xxxxxx, xx xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, shall xx implemented based xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx virtual xxxxxxxx xxxxxxx by xxx xxxx hypervisor xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx of xxxxxx and/or xxxxxx xxxxx solutions in xxx Payment Xxxxxxxxxxx Xxxxx must be xxxxx xx a formal xxxx assessment, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx solution.

If xxxxxx xxxxx xxxxxxxxx xxx xxxx, xx is xxxxxxxxxx that the xxxxxxxxxxx level of xxx xxxxxxx xxxxxx xx xxx xxxxxxx xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx xxxxxx solutions xxxx xx segregated xxxx the xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (applicable xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx requirements (2.1 xx 2.6) relate xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx xx xxx Eurosystem as xxxxx xxxxxxxx xxx xxx smooth xxxxxxxxxxx xx the XXXXXX2 xxxxxx shall have x&xxxx;xxxxxxxx xxxxxxxxxx strategy xx place comprising xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx continuity xxxxx xxxxx be xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx xxxx xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx xx available.
Requirement 2.3	:	Xxx xxxx xxxxxxx xx the xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, in order xx avoid xxxx xxxx xxxxx xxx xxxxxxxx xx xxx xxxx xxxxx xx xxx xxxx xxxx. Xxx example, xxx xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid and xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx primary business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx of x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, xxx xxxxxxxx participant xxxxx xx xxxx to xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx xx xxxxx be xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx day xxx xxxx the xxxxxxxxx business day(s).
Requirement 2.5	:	Xxxxxxxxxx shall be xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx xxxxxxx xxxx xxx alternate xxxx xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx xxx xxxxxxx xxxxxxxxxx of xxxxxxx xxx xxxxxxxxxxxx xx xxx criticality xx xxx xxxxxxxx xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx to xxxx xxxx operational disruptions xxxxx be xxxxxx xx least once x&xxxx;xxxx and xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx xxx xxxxxx one xxxx.