Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements xxxxxxxxx xxxxxxxxxxx security xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx each xxxxxxxxxxx, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx to it. Xx xxxxxxxxxxxx the xxxxx xx xxxxxxxxxxx xx the xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the xxxxxxxx xxxx are xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, the PTC xxxxxx at a Point xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx involved xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx applications, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx xx XXXXX (x.x. XXXXX XXX Xxx) or Xxxxxxxx (xxxx the xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx xxx a clear xxxxxx direction in xxxx xxxx xxxxxxxx xxxxxxxxxx and demonstrate xxxxxxx for xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx and xxxxxxxxxxx xx an xxxxxxxxxxx xxxxxxxx policy xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxxx xxx organisation xx xxxxx of identification, xxxxxxxxxx and xxxxxxxxx xx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxx. Xxx policy xxxxxx xxxxxxx xx xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx such xx organisation, human xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), xxxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx be established xx xxxxxxxxx the xxxxxxxxxxx security xxxxxx xxxxxx xxx organisation. Xxx xxxxxxxxxx shall xxxxxxxxxx and xxxxxx xxx xxxxxxxxxxxxx xx xxx xxxxxxxxxxx security xxxxxxxxx xx ensure xxx implementation xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx per Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, including xxx xxxxxxxxxx of xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx security xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx information xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx the xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx them. Xxx access xx xxx organisation’s xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx xxxxxxx xxxxx xx controlled. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx external xxxxxxx xxx required xx xxxxxx xxx xxxxxxxxxxxx’x information processing xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx xx xxxxxxx xxx xx xxxxxxxxx xxx xxxxxxxx implications xxx xxxxxxx requirements. Xxxxxxxx xxxxx be xxxxxx xxx xxxxxxx xx xx xxxxxxxxx xxxx each relevant xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, xxx xxxxxxxx xxxxxxxxx xxx the xxxxxxxxxx information xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx user-developed xxxxxxxxxxxx, xx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx accounted xxx and xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx xxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx xx assigned. Xxxx: the xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx specific xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx the xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx classification

Information xxxxxx xxxxx xx xxxxxxxxxx xx terms xx xxxxx xxxxxxxxxxx to xxx smooth delivery xx xxx xxxxxxx xx the participant. Xxx classification xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx protection xxxxxxxx xxxx xxxxxxxx the xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx shall xxxx xxxx into xxxxxxxxxxxxx the underlying XX components. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx by xxx xxxxxxxxxx xxxxx xx used to xxxxxx an appropriate xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx of xxxxxxxxxxx xxxxxx) and to xxxxxxxxxxx xxx xxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx adequate job xxxxxxxxxxxx xxx xx xxxxx and conditions xx employment. Xxx xxxxxxxxxx for xxxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx users xxxxx xx xxxxxxxxxx screened, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx third party xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xxxx xx xxxxxxxxx xx their xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx ensured xxxxx xxx employees, xxxxxxxxxxx xxx third xxxxx xxxxx, xxx xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx procedures xxx xxx xxxxxxx xxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx employees. Xxxxxxxxxxxxxxxx xxxxx xx xx xxxxx to xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx xxxx’x xxxx xxxx or xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, xxx xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx the xxxxxxx xx xxx xxxxxx xxxxxx are xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx security

Critical xx xxxxxxxxx information processing xxxxxxxxxx shall xx xxxxxx xx xxxxxx xxxxx, xxxxxxxxx by xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx security xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx xxxxx xx xxxxxxx xxxx to xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxxxxx xx protect physical xxxxx containing xxxxxxxxxxx xxxxxx when in xxxxxxx.

Xxxxxxxxx shall be xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx threats. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) and xxxxxxx xxx removal of xxxxxxxx xx xxxxxxxxx xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx to xxxxxxxxxxx xxx to guard xxxxxxx xxxx xx xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx may be xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx threats xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx such xx the xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx the xxxxxxxxxx xxx operation xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx all xxx xxxxxxxxxx xxxxxxx xx xxx Xxxxxxx Transaction Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx xxxxxxxxxx, including xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx duties xxxxx xx implemented, where xxxxxxxxxxx, xx xxxxxx xxx xxxx of xxxxxxxxx xx xxxxxxxxxx xxxxxx misuse. Where xxxxxxxxxxx xx duties xxxxxx xx xxxxxxxxxxx xxx to xxxxxxxxxx xxxxxxxxx xxxxxxx, compensatory xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx and xxxxxx xxx introduction xx xxxxxxxxx code xxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx user xxxxxxxxx) xx xxxxxxx, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Mobile xxxx xxxxx xx used xxxx xxxx trusted xxxxxxx (e.g. signed Xxxxxxxxx COM components xxx Java Xxxxxxx). Xxx configuration of xxx browser (x.x. xxx xxx xx xxxxxxxxxx xxx xxxxxxx) xxxxx xx strictly xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx xxxxx xx implemented xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx is xxxxxx xx xxxxxxx intervals xx xxxxx xxxxxxxx.

Xxxxxxx xxxx are xxxxxxxx xxx xxx security xx xxxxxxxx shall xx xxxxxxxxx xxx xxxxxx xxxxxxxx to xxxxxxxxxxx security xxxxx xx recorded. Xxxxxxxx xxxx shall xx xxxx xx ensure xxxx xxxxxxxxxxx xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxxxxxx xx a sample xxxxx, xxxxx on the xxxxxxxxxxx of xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx xxx xxxxxxxxxx xx xxxxxxxx for xxx security of xxxxxxxx xxx to xxxxxx conformity to xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx shall xx xxxxx xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx xx xxxx xxxx exchange xxxxxxxxxx among the xxxxxxxx parties and xxxxx xx compliant xxxx any relevant xxxxxxxxxxx. Xxxxx party xxxxxxxx components xxxxxxxx xx xxx xxxxxxxx xx information with XXXXXX2 (like xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx scenario 2 of the xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx the basis xx business xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) and xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx the xxxxxxxxxxx xxxxxxxx policy). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx based on xxx xxxxxxxxx of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx xxx xxxxx xx xxx xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx xxxxxxx should xx xxxxxxxxxx with xxxxxxxx access control xxxxxx xxxxx are xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx shall xx xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx xxxxxx rights xx xxxxxxxxxxx systems xxx services xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain. Xxx xxxxxxxxxx shall xxxxx xxx xxxxxx xx xxx lifecycle xx user xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx of xxx xxxxx to xxx xxxxx deregistration of xxxxx xxxx no xxxxxx xxxxxxx access.

Special xxxxxxxxx shall xx xxxxx, where appropriate, xx the xxxxxxxxxx xx xxxxxx xxxxxx xx such criticality xxxx xxx xxxxx xx xxxxx xxxxxx xxxxxx xxxxx lead xx x&xxxx;xxxxxx xxxxxxx xxxxxx on the xxxxxxxxxx xx the xxxxxxxxxxx (e.g. xxxxxx xxxxxx allowing xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx controls, direct xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx shall xx put in xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx at xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x network, e.g. xxx local xxx xxxxxx access xx xxxxxxx in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx be xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx be xxxxxxxxxxx and xxxxxxxx xx specific xxxxxxxx xx xxxxxx xxxx xxxxxxxxx xxxxxx be xxxxxx xxxxxxx, e.g. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx recovery and/or xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xx xxx xxx of xxxxxxxxxxxxx xxxxxxxx to protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx xx xxxxxxxxxxx xx support xxx xxx xx xxxxxxxxxxxxx controls.

There xxxxx xx policy xxx xxxxxxx confidential xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, a clear xxxx policy) xx xxxxxx the xxxx xx xxxxxxxxxxxx access.

When xxxxxxx xxxxxxxx, xxx xxxxx xx xxxxxxx xx an unprotected xxxxxxxxxxx xxxxx be xxxxxxxxxx and xxxxxxxxxxx xxxxxxxxx and xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx acquisition, development xxx maintenance

Security xxxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxx xxxxx xx the xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx controls xxxxx xx built xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx applications, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx xxxxxxxx shall xxxxxxx the xxxxxxxxxx xx input xxxx, xxxxxxxx processing xxx xxxxxx data. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, or xxxx an xxxxxx xx, xxxxxxxxx, valuable xx xxxxxxxx information. Xxxx xxxxxxxx xxxxx xx xxxxxxxxxx xx xxx basis xx xxxxxxxx xxxxxxxxxxxx and xxxx xxxxxxxxxx xxxxxxxxx xx the established xxxxxxxx (e.g. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx policy).

The xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, documented xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx xxx xxx. Xx xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, including xxxxxxxxxxxx xxx xxxxxx xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx of xxxx xxxxx xxx xxx xxxxx of xxxx xx xxx xxxxxxx xxxxx xx the xxxxxxxxxxxx. There shall xx xxxxxxxx xxxxxxxx xx xxxxxxx sensitive xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx xx controlled xxx IT xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Care xxxxx xx xxxxx xx xxxxx xxxxxxxx xx xxxxxxxxx data xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Deployment of xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx xxxxxxxxxx xx the major xxxxxxx to xx xxxxxxxx xx production xxxxx be xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx xxxxx also xx xxxxxxxxx according xx a predefined plan xxxxx xx xxx xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. All of xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx shall xx assessed and xxxxxx xxxxx to xxxxx xxx identified xxx xxxxx be xxxxxxxx xxx xxxxxxxx xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx the xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx are accessible xx xxxxxxxxx, information xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx risks xxxxxxxxxx with supplier’s xxxxxx xxxxx be xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx effective approach xx xxx xxxxxxxxxx xx information security xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx security xxxxxx xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx and procedures, xx xxxxxxxx and xxxxxxxxx level, xxxxx xx xxxxxxxxxxx and xxxxxx xx xxxxxx x&xxxx;xxxxx, effective xxx xxxxxxx xxx safely xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx xxxxxxxx xx xx xx xxxxxxx). Xxxxxxxxx involved xx these procedures xxxxx xx adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx systems (x.x. xxxx office xxxxxxx, xxxxxxxx xxxxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx be xxxxxxxxx xxxxxxxx xxx compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx of xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual xxxxxxxx xxxxx xxxxxx with xxx xxx xxxxxxxx xxxxxxxx xxxx are xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. hardening, xxxxxxx). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx xxxx xxxxxxx: xxxxxxxxx of the xxxxxxxxxx and the xxxxxxx xxxxxxxxx system, xxxxxxx patching, strict xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, logging and xxxxxxxxxx xx well xx managing xx xxxxxx xxxxxx, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx implemented xxxxx xx a risk assessment. Xxxxx virtual xxxxxxxx xxxxxxx by xxx xxxx xxxxxxxxxx xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx xxx/xx hybrid xxxxx xxxxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx must xx xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, taking xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx clauses xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions xxx xxxx, xx is xxxxxxxxxx that the xxxxxxxxxxx xxxxx xx xxx overall system xx the xxxxxxx xxx xx xxx xxxxxxxxx systems. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx xx xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx only xx xxxxxxxx participants)

The xxxxxxxxx requirements (2.1 xx 2.6) xxxxxx xx xxxxxxxx continuity xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx xxxxxxxxxx by xxx Xxxxxxxxxx xx xxxxx critical xxx xxx xxxxxx xxxxxxxxxxx xx xxx XXXXXX2 xxxxxx shall have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx place xxxxxxxxxx xxx following elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx them xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx xxxx profile xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx from xxxx xx xxx primary xxxx, xx xxxxx xx xxxxx xxxx xxxx sites are xxxxxxxx xx the xxxx xxxxx xx xxx xxxx xxxx. Xxx example, xxx xxxxxxxxx site shall xx xx x&xxxx;xxxxxxxxx xxxxx xxxx and xxxxxxx telecommunication xxxxxxx xxxx xxxxx xx xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx disruption xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx and/or critical xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx the xxxxxxxxx xxxx, xxxxx xx xxxxx xx possible xx xxxxxxxx xxxxx xxx xxxxxxxx day xxx xxxx the xxxxxxxxx business xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall xx xx place xx xxxxxx that xxx xxxxxxxxxx xx transactions xx xxxxxxx from xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx the initial xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx xx xxx criticality xx xxx business that xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx to cope xxxx xxxxxxxxxxx disruptions xxxxx xx xxxxxx xx least xxxx x&xxxx;xxxx and xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx trained. The xxxxxxx period xxxxxxx xxxxx shall xxx xxxxxx one xxxx.