Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxx continuity xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx management

These xxxxxxxxxxxx xxx xxxxxxxxxx xx xxxx xxxxxxxxxxx, xxxxxx xxx participant xxxxxxxxxxxx that x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx to xx. Xx xxxxxxxxxxxx xxx xxxxx of application xx xxx requirements xxxxxx xxx infrastructure, xxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxx xxxx xxx part xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (PTC). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. a system involved xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx at xxx xxxxxx responsible xx send the xxxxxxx xx SWIFT (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx the xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx policy

The xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx in xxxx xxxx xxxxxxxx xxxxxxxxxx and xxxxxxxxxxx xxxxxxx for xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx and xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx managing xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxxx xxx organisation xx xxxxx xx identification, xxxxxxxxxx and treatment xx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. The xxxxxx xxxxxx xxxxxxx xx xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, asset xxxxxxxxxx xxx.), principles xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx security policy xxxxxx the xxxxxxxxxxxx. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx review xxx xxxxxxxxxxxxx of xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx ensure xxx xxxxxxxxxxxxxx of xxx xxxxxxxxxxx security xxxxxx (as per Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx allocation xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x information xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx should not xx reduced xx xxx introduction of, xxx/xx xxx xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx products/services xxxxxxxx by xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx by xxxxxxxx xxxxxxx shall xx xxxxxxxxxx. Xxxx xxxxxxxx parties xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx required xx access xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, a risk xxxxxxxxxx xxxxx be carried xxx xx xxxxxxxxx xxx xxxxxxxx implications xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx be xxxxxx and xxxxxxx xx an agreement xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, xxx business xxxxxxxxx and xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx owner. Xxx xxxxxxxxxxxxxx xxx the xxxxxxxxxxx and xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx the xxxxxxxx processes and xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx assets xxxxx be xxxxxxxx. Xxxx: xxx xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx xx appropriate, xxx xxxxxxx xxxxxxxxxxx xxx the proper xxxxxxxxxx xx the xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxx xx xxxxx xx xxxxx criticality xx xxx xxxxxx xxxxxxxx xx xxx xxxxxxx xx xxx xxxxxxxxxxx. Xxx classification xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx the xxxxxxxxxxx asset xx xxx xxxxxxxx business xxxxxxxxx xxx shall xxxx xxxx xxxx xxxxxxxxxxxxx the xxxxxxxxxx XX xxxxxxxxxx. Xx xxxxxxxxxxx asset xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx xx protection xxxxxxxx throughout xxx xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx information xxxxxx) xxx xx xxxxxxxxxxx xxx need xxx specific handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx security

Security xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx xxx xx xxxxx xxx conditions xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx and xxxxx xxxxx xxxxx shall xx adequately screened, xxxxxxxxxx for xxxxxxxxx xxxx. Employees, xxxxxxxxxxx xxx xxxxx party xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xx xxxxx xxxxxxxx xxxxx and responsibilities. Xx xxxxxxxx level xx awareness shall xx ensured among xxx xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, xxx education xxx xxxxxxxx in xxxxxxxx procedures xxx xxx xxxxxxx use xx information processing xxxxxxxxxx shall xx xxxxxxxx xx xxxx xx minimise xxxxxxxx xxxxxxxx xxxxx. A formal xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx breaches xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx to xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx xx transfer xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, xxx xxxx the return xx xxx xxxxxxxxx xxx xxx xxxxxxx xx xxx access xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx or xxxxxxxxx information xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx xx xxxxxx xxxxx, xxxxxxxxx xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx security xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx physically xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx and interference. Xxxxxx xxxxx be xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx xxxxxxxx xxx environmental xxxxxxx. Xxxxxxxxxx xx equipment (xxxxxxxxx equipment xxxx xxx-xxxx) and xxxxxxx xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx reduce the xxxx xx xxxxxxxxxxxx xxxxxx xx information xxx xx xxxxx xxxxxxx xxxx xx xxxxxx of xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx xx safeguard xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx be xxxxxxxxxxx xxx xxx management xxx operation xx xxxxxxxxxxx processing xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Transaction Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx administration of XX xxxxxxx, segregation xx xxxxxx xxxxx xx xxxxxxxxxxx, where xxxxxxxxxxx, to reduce xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx be implemented xxx to documented xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx following a formal xxxx xxxxxxxx. Controls xxxxx xx xxxxxxxxxxx xx prevent and xxxxxx xxx xxxxxxxxxxxx xx xxxxxxxxx xxxx xxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Controls shall xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx prevent, xxxxxx xxx remove xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx be xxxx xxxx xxxx trusted xxxxxxx (x.x. signed Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (e.g. xxx xxx of xxxxxxxxxx xxx xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx xxxxx xx implemented xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx tested xx xxxxxxx xxxxxxxxx xx xxxxx annually.

Systems xxxx xxx xxxxxxxx xxx xxx security xx payments shall xx monitored xxx xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx shall xx recorded. Xxxxxxxx xxxx xxxxx be xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx identified. Xxxxxxxx logs xxxxx xx xxxxxxxxx xxxxxxxx xx a sample basis, xxxxx xx xxx xxxxxxxxxxx xx the xxxxxxxxxx. System xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx xx xxxxxxxx xxxxx are xxxxxxxxxx xx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx and xx xxxxxx xxxxxxxxxx xx xx access policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations shall xx xxxxx on x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx xx xxxx with xxxxxxxx xxxxxxxxxx xxxxx the xxxxxxxx xxxxxxx xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx components xxxxxxxx xx the xxxxxxxx xx information xxxx XXXXXX2 (like software xxxxxxxx xxxx a Service Xxxxxx xx xxxxxxxx 2 xx xxx xxxxx xxxxxxx of xxx TARGET2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx third party.

Requirement 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx the xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx according xx xxx xxxxxxxxxxx xxxxxxxxx xx corporate xxxxxxxx (including the xxxxxxxxxxx xxxxxxxx policy). Xxxxx xxxxxx control xxxxx shall xx xxxxxxx xxxxx on xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) to xxxxxxx xxxxxxx xxx xxxxx of the xxxxxxxxxxxxx xxxxxxxx xxx XX xxxxxxxxx. Where xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx xxxxxxx should xx xxxxxxxxxx xxxx xxxxxxxx access xxxxxxx xxxxxx xxxxx xxx xxxxxxxx compensatory xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx and documented xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx systems xxx services that xxxx xxxxxx xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxx xxxxxxxxxx xxxxx xxxxx xxx stages xx the xxxxxxxxx xx xxxx access, xxxx xxx xxxxxxx xxxxxxxxxxxx xx xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx of xxxxx that xx xxxxxx xxxxxxx access.

Special xxxxxxxxx xxxxx xx xxxxx, where appropriate, xx xxx allocation xx xxxxxx xxxxxx xx xxxx criticality xxxx the xxxxx xx those xxxxxx xxxxxx could xxxx xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx of xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, override of xxxxxx controls, xxxxxx xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx in xxxxx xx identify, xxxxxxxxxxxx and authorise xxxxx xx specific xxxxxx in xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local xxx xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Transaction Xxxxx. Xxxxxxxx accounts shall xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx and xxxxxxxx xx specific xxxxxxxx xx ensure xxxx xxxxxxxxx xxxxxx be xxxxxx guessed, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. A safe xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx and xxxxxxxxxxx xx the xxx xx xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx integrity of xxxxxxxxxxx. X&xxxx;xxx management xxxxxx shall be xxxxxxxxxxx to xxxxxxx xxx use of xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx information xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx policy) xx xxxxxx the xxxx xx unauthorised xxxxxx.

Xxxx xxxxxxx remotely, the xxxxx of xxxxxxx xx an unprotected xxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, development xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx be identified xxx xxxxxx xxxxx xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be built xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx controls xxxxx xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx xxx systems xxxx process, xx xxxx xx impact xx, xxxxxxxxx, xxxxxxxx xx xxxxxxxx information. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx on xxx xxxxx of xxxxxxxx xxxxxxxxxxxx xxx xxxx assessment according xx xxx established xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx operational xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, documented and xxxxxx prior to xxxxx acceptance xxx xxx. Xx xxxxxxx xxxxxxx security, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx secure xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx on the xxxxxxxxxxx xx xxxx xxxxx xxx xxx xxxxx xx risk xx xxx xxxxxxx xxxxx in the xxxxxxxxxxxx. There xxxxx xx specific xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx networks.

Access xx xxxxxx files xxx xxxxxxx xxxxxx code xxxxx xx xxxxxxxxxx xxx XX projects xxx xxxxxxx activities xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx taken to xxxxx exposure of xxxxxxxxx xxxx xx xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx xx production xxxxx xx xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx the xxxxx xxxxxxx xx xx xxxxxxxx xx production xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx systems in xxxxxxxxxx shall xxxx xx conducted xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx xx xxx xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx highlighted xxxxxx xxx security xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx and xxxxxx xxxxx xx xxxxx any xxxxxxxxxx xxx shall be xxxxxxxx xxx xxxxxxxx xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx the participant’s xxxxxxxx information xxxxxxx xxxx are xxxxxxxxxx xx xxxxxxxxx, information xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx supplier’s xxxxxx shall xx xxxxxxxxxx and formally xxxxxx xxxx xxxx xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx a consistent xxx xxxxxxxxx xxxxxxxx xx xxx xxxxxxxxxx xx information security xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx business xxx xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx xx ensure x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx xxx safely xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx incidents xxxxxxxxx xxxxxxxxx xxxxxxx to x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx pursued xx xx xxxxxxxx xxxxxxxx xx xx xx xxxxxxx). Personnel involved xx xxxxx procedures xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx review

A participant’s xxxxxxxx xxxxxxxxxxx systems (x.x. xxxx office systems, xxxxxxxx xxxxxxxx and xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx regularly xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx framework xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx machines xxxxx comply with xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx for xxxxxxxx xxxxxxxx and systems (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx include: xxxxxxxxx of the xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx patching, strict xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx and xxxxxxxxxx as xxxx xx xxxxxxxx of xxxxxx xxxxxx, xx xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, shall xx xxxxxxxxxxx based xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx by xxx xxxx hypervisor shall xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx xxx/xx xxxxxx xxxxx xxxxxxxxx in xxx Payment Xxxxxxxxxxx Xxxxx must xx xxxxx xx x&xxxx;xxxxxx xxxx assessment, xxxxxx xxxx account xxx xxxxxxxxx controls xxx xxx xxxxxxxxxxx clauses xxxxxxx xx xxx xxxxx solution.

If xxxxxx xxxxx xxxxxxxxx xxx xxxx, it is xxxxxxxxxx xxxx xxx xxxxxxxxxxx level of xxx xxxxxxx system xx xxx highest xxx xx xxx xxxxxxxxx systems. All xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx business xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx classified xx xxx Eurosystem xx xxxxx critical xxx xxx smooth functioning xx xxx XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx strategy xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx for xxxxxxxxxxx xxxx are xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx be xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx profile xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx primary xxxx, xx order xx xxxxx xxxx xxxx xxxxx are xxxxxxxx by xxx xxxx xxxxx xx xxx same xxxx. Xxx xxxxxxx, the xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid and xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary site xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx unavailable, xxx xxxxxxxx participant xxxxx xx able xx xxxxxx xxxxxx xxxxxxxxxx xxxx the xxxxxxxxx xxxx, xxxxx it xxxxx be xxxxxxxx xx xxxxxxxx close xxx business xxx xxx xxxx the xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx place xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx of service xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxx that xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx cope xxxx xxxxxxxxxxx disruptions xxxxx xx tested xx xxxxx xxxx x&xxxx;xxxx and critical xxxxx xxxxx xx xxxxxxxxxxxxx trained. The xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx xxx xxxxxx one xxxx.