Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements regarding xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business continuity xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx xxxx participant, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx xx xxx xxxxxxxxxx xx it. Xx xxxxxxxxxxxx xxx xxxxx xx application xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx are xxxx xx the Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (PoE), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx and xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx xxxx the xxxxxxx xx XXXXX (x.x. SWIFT XXX Xxx) xx Xxxxxxxx (xxxx xxx latter xxxxxxxxxx to Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx xxx a clear xxxxxx xxxxxxxxx xx xxxx with business xxxxxxxxxx and xxxxxxxxxxx xxxxxxx xxx and xxxxxxxxxx xx information xxxxxxxx through xxx xxxxxxxx, approval and xxxxxxxxxxx of xx xxxxxxxxxxx xxxxxxxx policy xxxxxx at managing xxxxxxxxxxx security xxx xxxxx resilience xxxxxx xxx xxxxxxxxxxxx in xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx treatment xx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxx. Xxx xxxxxx xxxxxx xxxxxxx at xxxxx xxx following xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx domains xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx xxx xxxxxxxxxx xx responsibilities.

Requirement 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy xxxxxx the xxxxxxxxxxxx. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx review xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx implementation of xxx information xxxxxxxx xxxxxx (xx xxx Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx by xxx introduction xx, xxx/xx the xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx by them. Xxx access to xxx organisation’s xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx by xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx external xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be carried xxx xx xxxxxxxxx xxx security xxxxxxxxxxxx xxx control xxxxxxxxxxxx. Xxxxxxxx xxxxx be xxxxxx and xxxxxxx xx xx xxxxxxxxx xxxx each xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx systems, xxxx as xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx products, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx xx the Xxxxxxx Transaction Chain xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx and xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx IT xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxx. Xxxx: the xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx assets xxxxx xx classified xx xxxxx xx xxxxx criticality to xxx xxxxxx delivery xx xxx service xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx xx xxx relevant business xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx underlying XX components. An xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx used to xxxxxx xx appropriate xxx of protection xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx asset lifecycle (xxxxxxxxx removal xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx the need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx addressed xxxxx to xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx xxx in xxxxx and xxxxxxxxxx xx xxxxxxxxxx. All xxxxxxxxxx xxx employment, xxxxxxxxxxx and xxxxx xxxxx users xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Employees, xxxxxxxxxxx xxx third party xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xxxx xx agreement xx their xxxxxxxx xxxxx and xxxxxxxxxxxxxxxx. Xx xxxxxxxx level xx xxxxxxxxx xxxxx xx xxxxxxx among xxx employees, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, and education xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx xxx xxx correct xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx be xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Responsibilities xxxxx be in xxxxx xx xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x or xxxxx xxxxx user’s xxxx xxxx or xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, xxx xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx the removal xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx security

Critical or xxxxxxxxx xxxxxxxxxxx processing xxxxxxxxxx xxxxx be xxxxxx xx xxxxxx xxxxx, xxxxxxxxx xx xxxxxxx security perimeters, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. They xxxxx xx physically xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx xxx interference. Xxxxxx xxxxx xx xxxxxxx xxxx to xxxxxxxxxxx xxx fall xxxxxx xxx scope xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx protect xxxxxxxx xxxxx containing xxxxxxxxxxx xxxxxx xxxx in xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx against xxx xxxxxxx of xxxxxxxx is necessary xx xxxxxx xxx xxxx of xxxxxxxxxxxx xxxxxx to xxxxxxxxxxx xxx xx guard xxxxxxx loss xx xxxxxx xx equipment xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx threats xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx such xx the electrical xxxxxx and xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx procedures xxxxx xx xxxxxxxxxxx xxx xxx management xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx all xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX systems, segregation xx duties xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx reduce xxx xxxx of xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx duties xxxxxx be xxxxxxxxxxx xxx to xxxxxxxxxx xxxxxxxxx reasons, compensatory xxxxxxxx xxxxx be xxxxxxxxxxx xxxxxxxxx a formal xxxx analysis. Xxxxxxxx xxxxx xx established xx prevent and xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx. Xxxxxxxx shall xx also established (xxxxxxxxx user xxxxxxxxx) xx prevent, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx from xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX components xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx xx xxx browser (x.x. xxx xxx xx xxxxxxxxxx and xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx xx xxx management; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx x&xxxx;xxxx of xxx xxxxxxxxxxx process xxxxx is xxxxxx xx xxxxxxx intervals xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx the xxxxxxxx xx xxxxxxxx shall xx xxxxxxxxx and xxxxxx relevant to xxxxxxxxxxx xxxxxxxx xxxxx xx recorded. Operator xxxx xxxxx xx xxxx xx xxxxxx xxxx information system xxxxxxxx xxx identified. Xxxxxxxx xxxx shall xx xxxxxxxxx xxxxxxxx xx a sample xxxxx, xxxxx xx xxx xxxxxxxxxxx xx the xxxxxxxxxx. System xxxxxxxxxx xxxxx xx used xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx xxx xxxxxxxxxx xx xxxxxxxx for xxx xxxxxxxx xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx shall xx xxxxx xx x&xxxx;xxxxxx exchange xxxxxx, xxxxxxx xxx xx xxxx xxxx exchange xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxx with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 xx xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx used under x&xxxx;xxxxxx agreement with xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx information xxxxxx xxxxx xx xxxxxxxxx xx the basis xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx established xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx access control xxxxx shall be xxxxxxx based xx xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely the xxxxx of xxx xxxxxxxxxxxxx xxxxxxxx xxx XX xxxxxxxxx. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal xxxx xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxxx xxx allocation xx xxxxxx xxxxxx xx xxxxxxxxxxx xxxxxxx xxx services xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx shall xxxxx all xxxxxx xx xxx lifecycle xx xxxx xxxxxx, xxxx the initial xxxxxxxxxxxx xx xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx xx xxxxxx xxxxxxx access.

Special xxxxxxxxx xxxxx xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx allocation xx xxxxxx xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx abuse xx xxxxx xxxxxx xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx adverse xxxxxx on xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. access xxxxxx allowing xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx controls, xxxxxx xxxxxx xx business xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx to xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx at xxxxxxxx xxxxxx xx the xxxxxxxxxxxx’x network, e.g. xxx xxxxx xxx xxxxxx xxxxxx to xxxxxxx xx xxx Xxxxxxx Transaction Chain. Xxxxxxxx xxxxxxxx xxxxx xxx be xxxxxx xx order xx xxxxxx xxxxxxxxxxxxxx.

Xxx passwords, xxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx ensure xxxx xxxxxxxxx cannot xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx and xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx xxxxxxxx xxx/xx xxxxx protocol xxxxx xx established.

A policy xxxxx xx developed and xxxxxxxxxxx xx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. A key management xxxxxx xxxxx xx xxxxxxxxxxx to xxxxxxx xxx xxx of xxxxxxxxxxxxx xxxxxxxx.

Xxxxx shall xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx information xx screen or xx print (x.x. x&xxxx;xxxxx screen, a clear xxxx policy) to xxxxxx the xxxx xx xxxxxxxxxxxx access.

When xxxxxxx xxxxxxxx, the xxxxx xx xxxxxxx xx xx unprotected xxxxxxxxxxx xxxxx be xxxxxxxxxx xxx appropriate xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx agreed prior xx the xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx processing. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx validation xx input data, xxxxxxxx xxxxxxxxxx and xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx may xx xxxxxxxx xxx systems xxxx process, xx xxxx an impact xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx xx xxx xxxxx xx xxxxxxxx requirements xxx xxxx xxxxxxxxxx xxxxxxxxx xx the xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, cryptographic xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx new xxxxxxx shall be xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx xxx xxx. Xx xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx segmentation xxx xxxxxx management, xxxxxx be implemented xxxxx on xxx xxxxxxxxxxx xx xxxx xxxxx and xxx xxxxx xx xxxx xx the network xxxxx in xxx xxxxxxxxxxxx. Xxxxx xxxxx xx xxxxxxxx controls xx xxxxxxx xxxxxxxxx xxxxxxxxxxx passing xxxx xxxxxx networks.

Access xx xxxxxx files and xxxxxxx xxxxxx xxxx xxxxx xx xxxxxxxxxx xxx IT xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx in a secure xxxxxx. Xxxx xxxxx xx xxxxx xx xxxxx exposure of xxxxxxxxx xxxx in xxxx xxxxxxxxxxxx. Xxxxxxx xxx support environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx xxx xxxxx xxxxxxx xx xx xxxxxxxx xx xxxxxxxxxx xxxxx xx conducted.

Regular xxxxxxxx xxxxxxx activities xx xxxxxxx xx xxxxxxxxxx shall also xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx xxxx xxxxx on the xxxxxxx xx a risk xxxxxxxxxx, xxx security xxxxxxx shall xxxxxxx, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx xx xxx shortcomings highlighted xxxxxx xxx security xxxxxxx xxxxxxxxxx xxxxx xx assessed xxx xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx shall be xxxxxxxx xxx followed xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx in xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx ensure protection xx xxx xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems xxxx xxx xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx requirements xxx xxxxxxxxxx xxx risks xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx shall be xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx approach xx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx security events xxx weaknesses, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx and xxxxxx xxxxxxx from xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx attacker xx xx an xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx xxxxxxx (e.g. xxxx office xxxxxxx, xxxxxxxx networks and xxxxxxxx xxxxxxx connectivity) xxxxx xx regularly xxxxxxxx xxx xxxxxxxxxx xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx of xxxxxxxx (e.g. information xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx xxxxxx xxxx xxx xxx security xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, logging). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx and xxx xxxxxxx xxxxxxxxx system, xxxxxxx patching, xxxxxx xxxxxxxxxx xx different xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Centralised xxxxxxxxxx, xxxxxxx and xxxxxxxxxx xx xxxx xx xxxxxxxx xx xxxxxx xxxxxx, in xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, xxxxx xx implemented xxxxx xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx hypervisor xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx xxx/xx hybrid xxxxx xxxxxxxxx xx xxx Payment Transaction Xxxxx must xx xxxxx on x&xxxx;xxxxxx xxxx assessment, taking xxxx account the xxxxxxxxx controls xxx xxx contractual xxxxxxx xxxxxxx to xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions are xxxx, xx is xxxxxxxxxx that the xxxxxxxxxxx xxxxx xx xxx overall xxxxxx xx xxx xxxxxxx xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx components of xxx xxxxxx xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx other xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx participants)

The xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) relate xx business xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx xx xxxxx critical xxx xxx xxxxxx functioning xx xxx TARGET2 xxxxxx xxxxx have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx place comprising xxx following elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx developed xxx procedures for xxxxxxxxxxx xxxx xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx risk xxxxxxx xx the xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx primary xxxx, in xxxxx xx xxxxx xxxx xxxx sites are xxxxxxxx xx xxx xxxx xxxxx xx xxx xxxx time. Xxx xxxxxxx, xxx xxxxxxxxx site xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx the xxxxx xx a major xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary xxxx xxxxxxxxxxxx and/or critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx the xxxxxxxxx xxxx, xxxxx xx xxxxx be possible xx xxxxxxxx close xxx xxxxxxxx xxx xxx xxxx xxx xxxxxxxxx xxxxxxxx day(s).
Requirement 2.5	:	Xxxxxxxxxx xxxxx be xx place xx xxxxxx that the xxxxxxxxxx xx xxxxxxxxxxxx xx resumed from xxx alternate xxxx xxxxxx a reasonable timeframe xxxxx xxx xxxxxxx xxxxxxxxxx xx service xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxx xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx once x&xxxx;xxxx xxx xxxxxxxx xxxxx shall be xxxxxxxxxxxxx trained. Xxx xxxxxxx xxxxxx xxxxxxx xxxxx shall xxx xxxxxx xxx xxxx.