Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements xxxxxxxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx are xxxxxxxxxx xx each participant, xxxxxx xxx participant xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx xx not xxxxxxxxxx xx it. Xx xxxxxxxxxxxx xxx xxxxx xx application xx xxx xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxx xxxx are xxxx xx the Payment Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (PoE), x.x. a system xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, front-office and xxxx-xxxxxx applications, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx responsible xx send the xxxxxxx xx XXXXX (x.x. SWIFT XXX Xxx) xx Xxxxxxxx (xxxx the latter xxxxxxxxxx to Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx xxxxxx

Xxx management xxxxx set x&xxxx;xxxxx xxxxxx direction xx xxxx xxxx business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx and xxxxxxxxxxx xx xx xxxxxxxxxxx security xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx security and xxxxx resilience xxxxxx xxx organisation xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx and xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxx. The xxxxxx xxxxxx xxxxxxx at xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), principles xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx security xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx organisation. Xxx management xxxxx xxxxxxxxxx xxx xxxxxx xxx xxxxxxxxxxxxx xx xxx information xxxxxxxx xxxxxxxxx xx xxxxxx xxx implementation of xxx xxxxxxxxxxx security xxxxxx (as xxx Xxxxxxxxxxx 1.1) xxxxxx xxx organisation, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx security xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx xxxxxxxx of xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx not xx reduced xx xxx xxxxxxxxxxxx of, xxx/xx xxx xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx xxxxxx xx xxx organisation’s information xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties shall xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx are xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x information processing xxxxxxxxxx, x&xxxx;xxxx assessment xxxxx xx carried xxx to xxxxxxxxx xxx security xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx and defined xx an agreement xxxx xxxx relevant xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx and the xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx as operating xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, off-the-shelf xxxxxxxx, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx be accounted xxx and have x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx xxx the xxxxxxxxxxx xxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx in the xxxxxxxx xxxxxxxxx and xxx xxxxxxx XX xxxxxxxxxx to xxxxxxxxx xxx information xxxxxx xxxxx be xxxxxxxx. Xxxx: the xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx xxx proper xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx assets xxxxx xx classified xx terms xx xxxxx xxxxxxxxxxx to xxx xxxxxx xxxxxxxx xx the xxxxxxx xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx the need, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx in xxx relevant xxxxxxxx xxxxxxxxx and xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx asset classification xxxxxx approved by xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx xxx xxxx xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx xxxxxxxxx xxxxx to employment xx xxxxxxxx xxx xxxxxxxxxxxx xxx in xxxxx and xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx and xxxxx xxxxx xxxxx shall xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx for xxxxxxxxx xxxx. Employees, contractors xxx xxxxx xxxxx xxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx an xxxxxxxxx xx their xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx adequate xxxxx xx xxxxxxxxx shall xx xxxxxxx among xxx xxxxxxxxx, contractors xxx xxxxx party xxxxx, xxx education xxx xxxxxxxx in xxxxxxxx procedures and xxx correct xxx xx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx to xxxx xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security breaches xxxxx be xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be in xxxxx to ensure xxxx xx xxxxxxxx’x, xxxxxxxxxx’x or third xxxxx xxxx’x exit xxxx xx transfer xxxxxx the xxxxxxxxxxxx xx xxxxxxx, and xxxx the xxxxxx xx all xxxxxxxxx xxx the xxxxxxx xx all xxxxxx xxxxxx are completed.

Requirement 1.7: Physical and xxxxxxxxxxxxx security

Critical or xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xx xxxxxx in secure xxxxx, protected xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx security xxxxxxxx xxx entry xxxxxxxx. Xxxx shall xx physically protected xxxx unauthorised xxxxxx, xxxxxx xxx interference. Xxxxxx shall xx xxxxxxx only xx xxxxxxxxxxx who fall xxxxxx xxx scope xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx xx established xx protect xxxxxxxx xxxxx containing xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx shall xx xxxxxxxxx xxxx xxxxxxxx xxx environmental xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx xx xxxxxxxx xx xxxxxxxxx xx reduce xxx xxxx xx xxxxxxxxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxx xxxxxxx xxxx xx xxxxxx of xxxxxxxxx xx information. Xxxxxxx xxxxxxxx may xx xxxxxxxx xx xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx xx safeguard xxxxxxxxxx xxxxxxxxxx xxxx xx xxx electrical xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx be xxxxxxxxxxx xxx xxx xxxxxxxxxx xxx operation of xxxxxxxxxxx processing xxxxxxxxxx xxxxxxxx all xxx xxxxxxxxxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx end-to-end.

As regards xxxxxxxxx xxxxxxxxxx, including xxxxxxxxx xxxxxxxxxxxxxx xx XX systems, xxxxxxxxxxx xx xxxxxx shall xx implemented, where xxxxxxxxxxx, xx reduce xxx xxxx xx xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Where xxxxxxxxxxx xx xxxxxx xxxxxx be implemented xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx shall be xxxxxxxxxxx following a formal xxxx xxxxxxxx. Xxxxxxxx xxxxx be xxxxxxxxxxx xx prevent xxx xxxxxx xxx xxxxxxxxxxxx xx malicious xxxx xxx systems xx xxx Xxxxxxx Transaction Xxxxx. Controls shall xx xxxx established (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, xxxxxx xxx xxxxxx malicious xxxx. Xxxxxx code xxxxx be xxxx xxxx xxxx xxxxxxx xxxxxxx (e.g. signed Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Xxxxxxx). Xxx xxxxxxxxxxxxx of xxx xxxxxxx (x.x. xxx use xx xxxxxxxxxx xxx plugins) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx the security xx xxxxxxxx xxxxx xx monitored xxx xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx shall xx recorded. Xxxxxxxx xxxx xxxxx be xxxx xx ensure xxxx xxxxxxxxxxx system xxxxxxxx are xxxxxxxxxx. Xxxxxxxx xxxx shall xx xxxxxxxxx xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx xx the xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx xx controls xxxxx xxx xxxxxxxxxx xx xxxxxxxx for xxx xxxxxxxx of xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx access policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx shall xx based xx x&xxxx;xxxxxx exchange xxxxxx, xxxxxxx out in xxxx xxxx xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx parties xxx xxxxx xx xxxxxxxxx xxxx any xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx components employed xx xxx xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (like xxxxxxxx xxxxxxxx xxxx a Service Xxxxxx xx xxxxxxxx 2 of xxx xxxxx xxxxxxx of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) must xx used xxxxx x&xxxx;xxxxxx xxxxxxxxx with xxx third xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx control

Access xx xxxxxxxxxxx assets xxxxx xx xxxxxxxxx xx the basis xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx based on xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely xxx xxxxx of xxx xxxxxxxxxxxxx xxxxxxxx xxx XX processes. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) logical xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx control xxxxxx xxxxx are xxxxxxxx compensatory controls xx place (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxxx the xxxxxxxxxx xx access rights xx xxxxxxxxxxx xxxxxxx xxx services xxxx xxxx xxxxxx xxx xxxxx xx the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx procedures xxxxx xxxxx xxx xxxxxx xx the xxxxxxxxx xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx of xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx of xxxxx xxxx xx xxxxxx xxxxxxx access.

Special xxxxxxxxx shall be xxxxx, where xxxxxxxxxxx, xx the allocation xx xxxxxx xxxxxx xx such xxxxxxxxxxx xxxx xxx xxxxx xx xxxxx xxxxxx xxxxxx xxxxx lead xx a severe xxxxxxx xxxxxx xx the xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, xxxxxx xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx put in xxxxx xx identify, xxxxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x network, e.g. xxx xxxxx xxx xxxxxx xxxxxx xx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx accounts xxxxx xxx xx shared xx xxxxx to xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx xxxxxx that xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx recovery and/or xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx xxx xxxxxxxxxxx on xxx xxx of xxxxxxxxxxxxx xxxxxxxx xx xxxxxxx xxx confidentiality, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx shall xx xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx shall xx policy for xxxxxxx confidential xxxxxxxxxxx xx screen xx xx print (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx policy) xx xxxxxx xxx xxxx xx xxxxxxxxxxxx access.

When xxxxxxx remotely, xxx xxxxx of xxxxxxx xx xx unprotected xxxxxxxxxxx xxxxx be xxxxxxxxxx xxx appropriate xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx be xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx be xxxxxxxxxx xxx agreed xxxxx xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx controls xxxxx be built xxxx applications, xxxxxxxxx xxxx-xxxxxxxxx applications, to xxxxxx xxxxxxx processing. Xxxxx controls xxxxx xxxxxxx xxx xxxxxxxxxx xx xxxxx data, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx for xxxxxxx xxxx xxxxxxx, xx xxxx xx impact xx, xxxxxxxxx, valuable xx xxxxxxxx information. Xxxx xxxxxxxx xxxxx xx determined on xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx xxx xxxx xxxxxxxxxx according xx xxx established xxxxxxxx (x.x. information xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

The operational xxxxxxxxxxxx of xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx xxx xxxxxx xxxxx xx xxxxx acceptance xxx xxx. Xx regards xxxxxxx security, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx xxxxxx management, xxxxxx xx implemented xxxxx xx xxx xxxxxxxxxxx xx xxxx xxxxx and the xxxxx of xxxx xx xxx xxxxxxx xxxxx in the xxxxxxxxxxxx. Xxxxx shall xx xxxxxxxx controls xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx be xxxxxxxxxx xxx XX xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Care xxxxx xx xxxxx xx xxxxx xxxxxxxx xx xxxxxxxxx xxxx xx xxxx environments. Xxxxxxx xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx xxxxx xxxxxxx xx xx xxxxxxxx xx production xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx systems xx xxxxxxxxxx xxxxx xxxx xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx xxx xxxxxxx xx a risk xxxxxxxxxx, and security xxxxxxx xxxxx xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx the xxxxxxxx xxxxxxx activities xxxxx xx assessed xxx xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx xxxxx xx xxxxxxxx xxx followed xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx in xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx ensure protection xx xxx participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx xxxxxxxxxx xx suppliers, information xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx be xxxxxxxxxx xxx xxxxxxxx xxxxxx upon xxxx xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx information xxxxxxxx incidents and xxxxxxxxxxxx

Xx xxxxxx a consistent xxx xxxxxxxxx xxxxxxxx xx the xxxxxxxxxx xx xxxxxxxxxxx security xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx procedures, xx xxxxxxxx xxx xxxxxxxxx level, shall xx established xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx and xxxxxx xxxxxxx from information xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related to x&xxxx;xxxxx-xxxxxxx cause (x.x. x&xxxx;xxxxx xxxxxxx by xx external xxxxxxxx xx xx xx xxxxxxx). Xxxxxxxxx involved xx xxxxx xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx systems (x.x. xxxx office xxxxxxx, xxxxxxxx xxxxxxxx and xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx regularly xxxxxxxx xxx xxxxxxxxxx xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (x.x. information xxxxxxxx xxxxxx, cryptographic xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx machines xxxxx xxxxxx xxxx xxx the xxxxxxxx xxxxxxxx xxxx are xxx for physical xxxxxxxx xxx systems (x.x. hardening, logging). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx include: xxxxxxxxx of the xxxxxxxxxx xxx xxx xxxxxxx operating xxxxxx, xxxxxxx patching, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx development). Xxxxxxxxxxx xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx xxxxxxxx xx xxxxxx xxxxxx, in xxxxxxxxxx xxx xxxx xxxxxxxxxx accounts, xxxxx xx xxxxxxxxxxx xxxxx xx x&xxxx;xxxx assessment. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx xxxxxxxxxx xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx xxxxxx xxxxx solutions in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx xx xxxxx xx x&xxxx;xxxxxx xxxx assessment, taking xxxx account the xxxxxxxxx controls xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx the xxxxx xxxxxxxx.

Xx hybrid xxxxx solutions are xxxx, it xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx xxx highest xxx xx the xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx be xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (applicable xxxx xx xxxxxxxx participants)

The xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) relate xx business continuity xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx classified by xxx Xxxxxxxxxx as xxxxx xxxxxxxx for xxx smooth xxxxxxxxxxx xx the XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx plans xxxxx xx developed xxx xxxxxxxxxx xxx xxxxxxxxxxx xxxx are xx xxxxx.
Xxxxxxxxxxx 2.2	:	An xxxxxxxxx xxxxxxxxxxx xxxx xxxxx xx available.
Requirement 2.3	:	Xxx xxxx xxxxxxx xx the xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, in xxxxx xx avoid xxxx xxxx xxxxx are xxxxxxxx xx the xxxx xxxxx xx xxx xxxx time. Xxx xxxxxxx, xxx xxxxxxxxx site shall xx on x&xxxx;xxxxxxxxx xxxxx grid xxx xxxxxxx telecommunication xxxxxxx xxxx those of xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In the xxxxx of x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx unavailable, the xxxxxxxx participant shall xx able to xxxxxx normal xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx it xxxxx be possible xx properly xxxxx xxx xxxxxxxx day xxx xxxx xxx xxxxxxxxx xxxxxxxx day(s).
Requirement 2.5	:	Xxxxxxxxxx shall xx xx place xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx resumed xxxx xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx the xxxxxxx xxxxxxxxxx of xxxxxxx xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx business that xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx xxxx xxxx operational xxxxxxxxxxx xxxxx be xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx critical xxxxx shall be xxxxxxxxxxxxx trained. Xxx xxxxxxx period xxxxxxx xxxxx shall xxx xxxxxx xxx xxxx.