Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx xx not xxxxxxxxxx to it. Xx establishing the xxxxx of xxxxxxxxxxx xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx participant xxxxxx xxxxxxxx xxx elements xxxx are xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx PTC xxxxxx xx a Point xx Xxxxx (PoE), x.x. x&xxxx;xxxxxx xxxxxxxx xx the creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, middleware), xxx ends xx xxx xxxxxx responsible xx send the xxxxxxx to XXXXX (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx policy

The xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx direction xx xxxx xxxx xxxxxxxx xxxxxxxxxx xxx demonstrate xxxxxxx xxx xxx xxxxxxxxxx to information xxxxxxxx through xxx xxxxxxxx, xxxxxxxx and xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx resilience xxxxxx xxx organisation xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx and xxxxxxxxx xx information xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. The xxxxxx xxxxxx contain xx xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx organisation, human xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx implement xxx xxxxxxxxxxx security policy xxxxxx xxx organisation. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx and review xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx implementation of xxx xxxxxxxxxxx security xxxxxx (xx per Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx allocation of xxxxxxxxxx xxxxxxxxx and xxxxxxxxxx xx security xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x information xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx not xx xxxxxxx by xxx xxxxxxxxxxxx of, xxx/xx xxx dependence xx, xx external xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x information xxxxxxxxxx facilities by xxxxxxxx parties xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx of external xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x information xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx xx xxxxxxxxx xxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxx requirements. Xxxxxxxx shall be xxxxxx and defined xx xx agreement xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx and xxx xxxxxxxxxx information xxxxxxx, xxxx xx operating xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, off-the-shelf xxxxxxxx, xxxxxxxx xxx user-developed xxxxxxxxxxxx, in xxx xxxxx xx xxx Xxxxxxx Transaction Xxxxx xxxxx xx xxxxxxxxx xxx xxx have x&xxxx;xxxxxxxxx owner. Xxx xxxxxxxxxxxxxx for the xxxxxxxxxxx xxx xxx xxxxxxxxx of appropriate xxxxxxxx in the xxxxxxxx processes and xxx xxxxxxx IT xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx assets xxxxx xx xxxxxxxx. Xxxx: xxx xxxxx xxx xxxxxxxx the xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx as xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx assets xxxxx be classified xx xxxxx of xxxxx xxxxxxxxxxx xx xxx smooth xxxxxxxx xx the xxxxxxx xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx the xxxx, xxxxxxxxxx and xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx asset xx xxx relevant xxxxxxxx xxxxxxxxx and xxxxx xxxx take xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX xxxxxxxxxx. Xx xxxxxxxxxxx asset classification xxxxxx xxxxxxxx by xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx appropriate xxx xx protection xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx asset xxxxxxxxx (xxxxxxxxx xxxxxxx and xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) and xx xxxxxxxxxxx xxx need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx responsibilities xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx job xxxxxxxxxxxx xxx in xxxxx xxx xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx for employment, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xxxx. Employees, contractors xxx xxxxx xxxxx xxxxx xx information xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx agreement xx xxxxx xxxxxxxx xxxxx and xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx shall xx ensured among xxx xxxxxxxxx, contractors xxx xxxxx party xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx procedures and xxx correct use xx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx to xxxx xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx employees. Xxxxxxxxxxxxxxxx xxxxx xx xx xxxxx to ensure xxxx an xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x exit xxxx or xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, and xxxx the xxxxxx xx all equipment xxx the xxxxxxx xx xxx xxxxxx xxxxxx are completed.

Requirement 1.7: Xxxxxxxx and xxxxxxxxxxxxx security

Critical xx xxxxxxxxx information processing xxxxxxxxxx xxxxx xx xxxxxx in xxxxxx xxxxx, xxxxxxxxx xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx and xxxxx xxxxxxxx. Xxxx shall xx physically xxxxxxxxx xxxx unauthorised xxxxxx, xxxxxx and xxxxxxxxxxxx. Xxxxxx shall xx xxxxxxx only xx xxxxxxxxxxx xxx fall xxxxxx xxx xxxxx xx Requirement 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx physical xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) and against xxx removal xx xxxxxxxx xx necessary xx xxxxxx xxx xxxx of xxxxxxxxxxxx xxxxxx to xxxxxxxxxxx xxx xx xxxxx xxxxxxx xxxx or xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx xxx xx xxxxxxxx to xxxxxxx xxxxxxx physical threats xxx xx safeguard xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx established xxx xxx xxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx the xxxxxxxxxx xxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx of XX systems, xxxxxxxxxxx xx duties shall xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, to reduce xxx risk xx xxxxxxxxx xx deliberate xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx following x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxxxxx xxx introduction xx malicious xxxx xxx xxxxxxx in xxx Xxxxxxx Transaction Xxxxx. Controls xxxxx xx also xxxxxxxxxxx (xxxxxxxxx user xxxxxxxxx) xx xxxxxxx, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx xxxx trusted xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (e.g. xxx xxx xx xxxxxxxxxx and plugins) xxxxx xx strictly xxxxxxxxxx.

Xxxx backup xxx xxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx policies shall xxxxxxx a plan xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx xxxxxxx xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx xxx security xx xxxxxxxx xxxxx xx monitored xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxx xx recorded. Xxxxxxxx xxxx shall xx xxxx xx xxxxxx xxxx information xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx logs xxxxx xx regularly xxxxxxxx xx a sample xxxxx, xxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx used xx xxxxx xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx identified xx xxxxxxxx for xxx security xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx to xx access policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations xxxxx xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out in xxxx xxxx exchange xxxxxxxxxx xxxxx xxx xxxxxxxx parties and xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Third xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx information with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 of xxx xxxxx section of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx party.

Requirement 1.9: Access control

Access xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx the xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx based xx xxx xxxxxxxxx xx xxxxx privilege (2) xx xxxxxxx xxxxxxx xxx xxxxx xx the xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Where xxxxxxxx (e.g. xxx xxxxxx management) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal xxxx xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxxx xxx allocation xx xxxxxx xxxxxx xx xxxxxxxxxxx xxxxxxx xxx services that xxxx xxxxxx xxx xxxxx xx the Xxxxxxx Transaction Chain. Xxx xxxxxxxxxx xxxxx xxxxx xxx xxxxxx xx xxx lifecycle xx xxxx xxxxxx, xxxx xxx initial xxxxxxxxxxxx of xxx xxxxx to the xxxxx xxxxxxxxxxxxxx xx xxxxx that no xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx xxxxxxxxxx xx xxxxxx rights xx such xxxxxxxxxxx xxxx xxx xxxxx xx those xxxxxx xxxxxx xxxxx xxxx xx a severe adverse xxxxxx xx the xxxxxxxxxx xx xxx xxxxxxxxxxx (e.g. xxxxxx xxxxxx allowing system xxxxxxxxxxxxxx, override xx xxxxxx xxxxxxxx, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx shall xx xxx xx xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local and xxxxxx xxxxxx to xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx be xxxxxx xx xxxxx to xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx shall xx xxxxxxxxxxx xxx xxxxxxxx xx specific xxxxxxxx xx ensure xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx rules and xxxxxxx-xxxx xxxxxxxx. A safe xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxxx on xxx xxx xx cryptographic xxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx integrity xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxx use of xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx policy xxx xxxxxxx confidential xxxxxxxxxxx xx xxxxxx xx xx xxxxx (e.g. x&xxxx;xxxxx xxxxxx, a clear xxxx policy) xx xxxxxx xxx risk xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, the xxxxx xx xxxxxxx xx an xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx xxxxxxxxxxx, development xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxx xxxxx xx xxx xxxxxxxxxxx xxx/xx implementation xx xxxxxxxxxxx systems.

Appropriate controls xxxxx xx xxxxx xxxx applications, xxxxxxxxx xxxx-xxxxxxxxx applications, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx xxxxxxxx xxxxx xxxxxxx xxx xxxxxxxxxx xx xxxxx data, xxxxxxxx xxxxxxxxxx xxx xxxxxx data. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx xxx xxxxxxx xxxx process, or xxxx xx impact xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx shall xx determined xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx xxx xxxx assessment xxxxxxxxx xx the established xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

The operational xxxxxxxxxxxx xx xxx xxxxxxx shall xx xxxxxxxxxxx, documented xxx xxxxxx prior xx xxxxx xxxxxxxxxx xxx xxx. As regards xxxxxxx xxxxxxxx, appropriate xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx secure xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx on xxx xxxxxxxxxxx of data xxxxx xxx the xxxxx xx risk xx the xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx specific xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx files and xxxxxxx xxxxxx xxxx xxxxx be controlled xxx XX xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx in a secure xxxxxx. Care xxxxx xx xxxxx to xxxxx xxxxxxxx xx xxxxxxxxx xxxx in xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx xx strictly xxxxxxxxxx. Deployment xx xxxxxxx in xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx xxx xxxxx xxxxxxx xx xx xxxxxxxx xx xxxxxxxxxx xxxxx xx conducted.

Regular xxxxxxxx xxxxxxx activities xx xxxxxxx xx xxxxxxxxxx xxxxx also xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx security xxxxxxx xxxxx xxxxxxx, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx of xxx shortcomings xxxxxxxxxxx xxxxxx xxx security xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xxx xxxxxx plans xx xxxxx xxx xxxxxxxxxx xxx xxxxx xx xxxxxxxx and followed xx in x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx supplier’s xxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxx xxxxxx upon with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx ensure a consistent xxx xxxxxxxxx xxxxxxxx xx the xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx events xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx xxxxx, shall xx xxxxxxxxxxx and xxxxxx xx xxxxxx x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx xxx xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx to x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx by xx external xxxxxxxx xx xx an xxxxxxx). Personnel involved xx xxxxx xxxxxxxxxx xxxxx be adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (e.g. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx be regularly xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx framework of xxxxxxxx (x.x. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx xxx security xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx systems (x.x. hardening, logging). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx operating xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. production xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, logging and xxxxxxxxxx as xxxx xx xxxxxxxx xx xxxxxx rights, in xxxxxxxxxx for xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx xxxxx xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx by xxx xxxx hypervisor xxxxx xxxx a similar xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx and/or xxxxxx xxxxx solutions in xxx Xxxxxxx Transaction Xxxxx xxxx xx xxxxx xx a formal xxxx assessment, xxxxxx xxxx account xxx xxxxxxxxx controls xxx xxx contractual xxxxxxx xxxxxxx to xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx the xxxxxxx xxx xx the xxxxxxxxx systems. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx hybrid xxxxxxxxx xxxx xx xxxxxxxxxx xxxx the xxxxx xx-xxxxxxxx systems.

Business continuity xxxxxxxxxx (applicable xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx requirements (2.1 xx 2.6) relate xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx classified xx xxx Xxxxxxxxxx xx xxxxx xxxxxxxx xxx xxx xxxxxx xxxxxxxxxxx xx the TARGET2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx continuity xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx for xxxxxxxxxxx them xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx xx available.
Requirement 2.3	:	Xxx xxxx profile xx the alternate xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx primary xxxx, xx xxxxx xx xxxxx xxxx xxxx sites xxx xxxxxxxx xx xxx xxxx event xx xxx xxxx xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid and xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those of xxx xxxxxxx business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In the xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary site xxxxxxxxxxxx xxx/xx critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx participant shall xx xxxx xx xxxxxx normal xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, where xx xxxxx xx xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx xxx xxx open xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall xx xx place xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx of xxxxxxx xxx xxxxxxxxxxxx to xxx criticality xx xxx xxxxxxxx xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx to xxxx xxxx operational disruptions xxxxx be tested xx xxxxx xxxx x&xxxx;xxxx and critical xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. The xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx not xxxxxx xxx year.