Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements regarding xxxxxxxxxxx security xxxxxxxxxx xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx are xxxxxxxxxx xx xxxx xxxxxxxxxxx, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx is xxx xxxxxxxxxx xx it. Xx xxxxxxxxxxxx xxx xxxxx xx xxxxxxxxxxx xx xxx requirements xxxxxx its xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxx xxxx xxx xxxx xx the Payment Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, the PTC xxxxxx at x&xxxx;Xxxxx xx Entry (PoE), x.x. a system involved xx the xxxxxxxx xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx ends xx xxx xxxxxx responsible xx xxxx xxx xxxxxxx to XXXXX (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx to Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set a clear xxxxxx direction in xxxx xxxx xxxxxxxx xxxxxxxxxx xxx demonstrate xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx the xxxxxxxx, xxxxxxxx and xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx across xxx organisation xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx treatment xx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxx. Xxx policy xxxxxx xxxxxxx at xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, scope (xxxxxxxxx xxxxxxx such xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx management xxx.), principles xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx security framework xxxxx be xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy xxxxxx xxx xxxxxxxxxxxx. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx implementation xx xxx information security xxxxxx (xx xxx Xxxxxxxxxxx 1.1) xxxxxx xxx organisation, including xxx xxxxxxxxxx xx xxxxxxxxxx resources xxx xxxxxxxxxx of xxxxxxxx xxxxxxxxxxxxxxxx xxx this xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx by xxx xxxxxxxxxxxx xx, xxx/xx xxx xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx or xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx xxx required xx xxxxxx xxx xxxxxxxxxxxx’x information processing xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx xx xxxxxxx xxx to xxxxxxxxx xxx security xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx xxx xxxxxxx xx xx xxxxxxxxx xxxx each xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, the xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, business xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx of xxx Xxxxxxx Transaction Xxxxx xxxxx xx xxxxxxxxx xxx xxx have x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx xxx xxx xxxxxxxxx xx appropriate xxxxxxxx xx the xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx to xxxxxxxxx xxx xxxxxxxxxxx assets xxxxx xx xxxxxxxx. Xxxx: xxx owner xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx remains accountable xxx xxx xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx classified xx terms of xxxxx criticality xx xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx the participant. Xxx classification xxxxx xxxxxxxx xxx need, xxxxxxxxxx xxx xxxxxx xx protection required xxxx xxxxxxxx the xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx and shall xxxx take xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX xxxxxxxxxx. An xxxxxxxxxxx xxxxx classification xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx appropriate xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx and xxxxxxxxxxx of xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx the xxxx xxx specific handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx security

Security xxxxxxxxxxxxxxxx xxxxx be xxxxxxxxx xxxxx xx employment xx xxxxxxxx xxx xxxxxxxxxxxx and in xxxxx xxx conditions xx xxxxxxxxxx. Xxx xxxxxxxxxx for employment, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xxxxx xx adequately xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx of xxxxxxxxxxx xxxxxxxxxx facilities xxxxx xxxx an xxxxxxxxx xx xxxxx security xxxxx xxx xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx xxxxxxx xxxxx xxx xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx xxx xxx correct use xx information xxxxxxxxxx xxxxxxxxxx shall be xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx. A formal xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Responsibilities xxxxx xx xx xxxxx xx xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx user’s xxxx xxxx xx xxxxxxxx xxxxxx the xxxxxxxxxxxx xx xxxxxxx, xxx xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx the removal xx all xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx and xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx xx xxxxxx xxxxx, protected xx xxxxxxx security perimeters, xxxx xxxxxxxxxxx security xxxxxxxx and xxxxx xxxxxxxx. Xxxx shall xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx and xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx to xxxxxxxxxxx xxx fall xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxxxxx xx protect physical xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx when xx xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx physical xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx xx xxxxxxxx is xxxxxxxxx xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx to xxxxxxxxxxx xxx to xxxxx xxxxxxx xxxx xx xxxxxx of xxxxxxxxx xx information. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx to safeguard xxxxxxxxxx facilities xxxx xx xxx xxxxxxxxxx xxxxxx xxx cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Transaction Xxxxx end-to-end.

As xxxxxxx xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx administration xx XX xxxxxxx, xxxxxxxxxxx xx duties xxxxx xx implemented, xxxxx xxxxxxxxxxx, xx xxxxxx xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx misuse. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Controls xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx awareness) xx xxxxxxx, xxxxxx xxx xxxxxx malicious xxxx. Xxxxxx xxxx xxxxx be xxxx xxxx xxxx trusted xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx xxx xxxxxxx) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx backup xxx xxxxxxxx xxxxxxxx xxxxx xx implemented xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx a plan of xxx xxxxxxxxxxx process xxxxx xx xxxxxx xx xxxxxxx xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx xxx security xx xxxxxxxx xxxxx xx xxxxxxxxx xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxx xx xxxxxx xxxx xxxxxxxxxxx system xxxxxxxx are xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx reviewed xx a sample xxxxx, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx used xx xxxxx xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxxxx xx xxxxxxxx for xxx xxxxxxxx xx xxxxxxxx and xx xxxxxx xxxxxxxxxx xx xx access policy xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx xxxxx xx based on x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx in xxxx xxxx xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx parties xxx xxxxx be xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx information xxxx XXXXXX2 (xxxx software xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx in xxxxxxxx 2 xx xxx xxxxx section of xxx TARGET2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) must xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Access control

Access xx information xxxxxx xxxxx xx justified xx the xxxxx xx xxxxxxxx requirements (xxxx-xx-xxxx&xxxx;(1)) xxx according xx xxx xxxxxxxxxxx xxxxxxxxx xx corporate xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy). Xxxxx access control xxxxx xxxxx xx xxxxxxx based on xxx principle xx xxxxx privilege (2) to xxxxxxx closely xxx xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Xxxxx xxxxxxxx (x.x. for xxxxxx management) logical xxxxxx xxxxxxx should xx xxxxxxxxxx xxxx xxxxxxxx access xxxxxxx xxxxxx xxxxx are xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx shall be xx xxxxx xx xxxxxxx xxx allocation xx xxxxxx xxxxxx xx information systems xxx xxxxxxxx xxxx xxxx within xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx shall xxxxx all stages xx xxx xxxxxxxxx xx user xxxxxx, xxxx the initial xxxxxxxxxxxx xx xxx xxxxx xx the xxxxx deregistration of xxxxx xxxx no xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx shall xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx allocation xx xxxxxx xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx xxxxx xx xxxxx xxxxxx xxxxxx xxxxx xxxx xx a severe xxxxxxx xxxxxx xx xxx xxxxxxxxxx of the xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, direct xxxxxx to business xxxx).

Xxxxxxxxxxx controls shall xx xxx xx xxxxx xx identify, xxxxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local and xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx accounts xxxxx xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx be xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxx xxxx xxxxxxxxx xxxxxx be xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx and xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx developed and xxxxxxxxxxx xx the xxx xx xxxxxxxxxxxxx xxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxxxxx, authenticity xxx integrity xx xxxxxxxxxxx. A key management xxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx for xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx screen, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx xxx risk xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx of working xx an unprotected xxxxxxxxxxx xxxxx xx xxxxxxxxxx and xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx xx xxxxxxxxxx xxx xxxxxx xxxxx xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx controls xxxxx xx xxxxx xxxx applications, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx controls shall xxxxxxx xxx xxxxxxxxxx xx xxxxx xxxx, xxxxxxxx processing xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx for xxxxxxx xxxx xxxxxxx, xx xxxx xx xxxxxx xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx determined on xxx basis of xxxxxxxx requirements and xxxx assessment xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

The operational xxxxxxxxxxxx of xxx xxxxxxx shall xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx to xxxxx xxxxxxxxxx and xxx. Xx xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx management, xxxxxx xx xxxxxxxxxxx xxxxx on xxx xxxxxxxxxxx xx xxxx xxxxx xxx xxx xxxxx xx xxxx xx the xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx specific xxxxxxxx xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx over xxxxxx xxxxxxxx.

Xxxxxx to xxxxxx files xxx xxxxxxx xxxxxx code xxxxx xx xxxxxxxxxx xxx IT xxxxxxxx xxx support xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Care xxxxx xx taken xx xxxxx exposure xx xxxxxxxxx xxxx xx xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx xx production xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx major xxxxxxx to xx xxxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx activities xx xxxxxxx xx xxxxxxxxxx shall also xx conducted xxxxxxxxx xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx include, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx xx xxx shortcomings xxxxxxxxxxx xxxxxx the xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xxx xxxxxx plans xx xxxxx xxx xxxxxxxxxx xxx shall xx xxxxxxxx xxx followed xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx ensure protection xx xxx xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx be xxxxxxxxxx and formally xxxxxx upon with xxx supplier.

Requirement 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx effective approach xx the xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx security events xxx weaknesses, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx xxxxx, xxxxx xx established xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, effective and xxxxxxx xxx xxxxxx xxxxxxx from information xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx xxxxxxx by xx xxxxxxxx xxxxxxxx xx by xx xxxxxxx). Personnel xxxxxxxx xx these xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx networks and xxxxxxxx network connectivity) xxxxx xx regularly xxxxxxxx for compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, logging). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx must xxxxxxx: xxxxxxxxx xx the xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx patching, xxxxxx xxxxxxxxxx xx different xxxxxxxxxxxx (x.x. production xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx and xxxxxxxxxx xx well xx xxxxxxxx of xxxxxx rights, xx xxxxxxxxxx for xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx implemented xxxxx xx x&xxxx;xxxx assessment. Xxxxx xxxxxxx machines xxxxxxx xx xxx xxxx hypervisor xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx xxxxxx xxxxx xxxxxxxxx in xxx Payment Xxxxxxxxxxx Xxxxx xxxx xx xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx account the xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx the xxxxx solution.

If xxxxxx xxxxx xxxxxxxxx are xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx xxx xxxxxxx xxx xx the xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx xxxxxx solutions xxxx be xxxxxxxxxx xxxx xxx other xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx critical participants)

The xxxxxxxxx requirements (2.1 xx 2.6) xxxxxx xx xxxxxxxx continuity xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx classified xx xxx Eurosystem xx xxxxx xxxxxxxx for xxx xxxxxx functioning xx xxx XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx continuity xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx them xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx xxxx xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx risk xxxxxxx xx xxx xxxxxxxxx xxxx shall xx xxxxxxxxx from that xx xxx xxxxxxx xxxx, xx order xx avoid xxxx xxxx xxxxx are xxxxxxxx xx xxx xxxx xxxxx xx xxx same time. Xxx example, xxx xxxxxxxxx xxxx xxxxx xx on a different xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx the xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx rendering xxx primary site xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx able to xxxxxx normal xxxxxxxxxx xxxx xxx alternate xxxx, where xx xxxxx xx xxxxxxxx xx xxxxxxxx close xxx xxxxxxxx xxx xxx xxxx the xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall be xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx of transactions xx xxxxxxx xxxx xxx alternate site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx xx xxx criticality xx xxx business xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx to xxxx xxxx operational disruptions xxxxx be tested xx xxxxx xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx be xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx between xxxxx xxxxx not xxxxxx xxx xxxx.