Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx security xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx management

These xxxxxxxxxxxx are applicable xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx xx xxx xxxxxxxxxx xx xx. Xx establishing xxx xxxxx of application xx xxx requirements xxxxxx xxx infrastructure, xxx participant xxxxxx xxxxxxxx the elements xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain (XXX). Xxxxxxxxxxxx, the PTC xxxxxx xx a Point xx Entry (PoE), x.x. x&xxxx;xxxxxx involved xx the xxxxxxxx xx xxxxxxxxxxxx (e.g. xxxxxxxxxxxx, xxxxx-xxxxxx and xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx send xxx xxxxxxx xx SWIFT (x.x. XXXXX VPN Xxx) or Internet (xxxx xxx latter xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx in xxxx with xxxxxxxx xxxxxxxxxx xxx demonstrate xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx the xxxxxxxx, approval and xxxxxxxxxxx of xx xxxxxxxxxxx security policy xxxxxx xx managing xxxxxxxxxxx security xxx xxxxx resilience xxxxxx xxx xxxxxxxxxxxx xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx cyber xxxxxxxxxx xxxxx. The policy xxxxxx xxxxxxx at xxxxx the xxxxxxxxx xxxxxxxx: objectives, xxxxx (xxxxxxxxx domains xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), principles xxx xxxxxxxxxx xx responsibilities.

Requirement 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx security xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx security xxxxxx xxxxxx the xxxxxxxxxxxx. Xxx management xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (as xxx Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, including xxx allocation xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx security xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx of xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx information xxxxxxxxxx xxxxxxxxxx xxxxxx xxx xx xxxxxxx xx xxx xxxxxxxxxxxx xx, xxx/xx the xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx xxxx. Xxx xxxxxx to xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties xxxxx xx controlled. When xxxxxxxx parties xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx are xxxxxxxx xx xxxxxx the xxxxxxxxxxxx’x xxxxxxxxxxx processing xxxxxxxxxx, a risk assessment xxxxx xx xxxxxxx xxx to xxxxxxxxx xxx security xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx be xxxxxx xxx xxxxxxx xx xx xxxxxxxxx xxxx each relevant xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx xxxxxxxxxx

Xxx information xxxxxx, xxx business xxxxxxxxx xxx the xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx xx the Xxxxxxx Transaction Chain xxxxx xx xxxxxxxxx xxx xxx have x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx and xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx to xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxx. Xxxx: xxx owner xxx xxxxxxxx xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx as xxxxxxxxxxx, xxx remains accountable xxx xxx xxxxxx xxxxxxxxxx of the xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx assets xxxxx be xxxxxxxxxx xx terms of xxxxx criticality to xxx xxxxxx xxxxxxxx xx the xxxxxxx xx the participant. Xxx xxxxxxxxxxxxxx shall xxxxxxxx xxx xxxx, xxxxxxxxxx xxx degree xx protection xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx in xxx relevant business xxxxxxxxx and shall xxxx take xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX xxxxxxxxxx. Xx xxxxxxxxxxx asset xxxxxxxxxxxxxx xxxxxx xxxxxxxx by xxx management xxxxx xx xxxx to xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxx throughout the xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx the need xxx xxxxxxxx handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx be addressed xxxxx to xxxxxxxxxx xx adequate xxx xxxxxxxxxxxx xxx in xxxxx xxx xxxxxxxxxx xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx and xxxxx xxxxx xxxxx xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xx information xxxxxxxxxx facilities xxxxx xxxx an agreement xx xxxxx xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx ensured among xxx xxxxxxxxx, contractors xxx third xxxxx xxxxx, xxx education xxx training in xxxxxxxx xxxxxxxxxx and xxx xxxxxxx use xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall be xxxxxxxx to xxxx xx xxxxxxxx possible xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx process xxx xxxxxxxx security breaches xxxxx be established xxx employees. Xxxxxxxxxxxxxxxx xxxxx xx xx xxxxx xx ensure xxxx an xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx user’s xxxx xxxx or xxxxxxxx xxxxxx xxx organisation xx xxxxxxx, and xxxx xxx xxxxxx xx xxx xxxxxxxxx xxx the removal xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Physical xxx xxxxxxxxxxxxx security

Critical xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx xx xxxxxx xxxxx, xxxxxxxxx xx xxxxxxx security perimeters, xxxx xxxxxxxxxxx security xxxxxxxx and xxxxx xxxxxxxx. Xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx xxxxxx, xxxxxx xxx interference. Xxxxxx xxxxx xx xxxxxxx only xx xxxxxxxxxxx who fall xxxxxx xxx scope xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx standards xxxxx be xxxxxxxxxxx xx xxxxxxx physical xxxxx containing information xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx shall xx xxxxxxxxx xxxx xxxxxxxx xxx environmental threats. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) and against xxx xxxxxxx xx xxxxxxxx is necessary xx xxxxxx the xxxx xx xxxxxxxxxxxx xxxxxx to information xxx xx xxxxx xxxxxxx loss xx xxxxxx of xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx be xxxxxxxx to xxxxxxx xxxxxxx physical threats xxx xx xxxxxxxxx xxxxxxxxxx facilities such xx xxx xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxx xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx facilities xxxxxxxx xxx the xxxxxxxxxx systems in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx administration xx XX systems, xxxxxxxxxxx xx duties xxxxx xx implemented, xxxxx xxxxxxxxxxx, xx xxxxxx xxx xxxx xx xxxxxxxxx xx xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx xxxxxxxxxxx xxx xx documented xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx prevent and xxxxxx xxx introduction xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx shall xx xxxx established (xxxxxxxxx xxxx xxxxxxxxx) xx xxxxxxx, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx xxxx trusted xxxxxxx (e.g. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx xxxxxxxxxxxxx xx xxx browser (x.x. xxx xxx xx xxxxxxxxxx and plugins) xxxxx be strictly xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx shall xx implemented xx xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx of xxx restoration xxxxxxx xxxxx xx tested xx regular intervals xx least xxxxxxxx.

Xxxxxxx xxxx xxx critical xxx the xxxxxxxx xx xxxxxxxx xxxxx xx monitored and xxxxxx xxxxxxxx xx xxxxxxxxxxx security xxxxx xx xxxxxxxx. Xxxxxxxx xxxx xxxxx be xxxx xx ensure xxxx xxxxxxxxxxx system xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx logs xxxxx xx regularly xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx monitoring xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx of controls xxxxx xxx xxxxxxxxxx xx xxxxxxxx for xxx security of xxxxxxxx and to xxxxxx xxxxxxxxxx to xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations xxxxx xx based on x&xxxx;xxxxxx exchange policy, xxxxxxx xxx xx xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx xxxxxxx and xxxxx xx xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx information xxxx XXXXXX2 (xxxx xxxxxxxx xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx in xxxxxxxx 2 of xxx xxxxx section of xxx TARGET2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) must xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx with xxx third xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx control

Access xx information xxxxxx xxxxx be justified xx the basis xx xxxxxxxx requirements (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx the xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx access xxxxxxx xxxxx xxxxx xx xxxxxxx based xx xxx principle of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx the xxxxx of xxx xxxxxxxxxxxxx business xxx XX processes. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx xxxxx are xxxxxxxx xxxxxxxxxxxx controls xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx be xx place xx xxxxxxx xxx xxxxxxxxxx xx access rights xx information xxxxxxx xxx xxxxxxxx that xxxx within xxx xxxxx xx xxx Xxxxxxx Transaction Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx stages xx xxx lifecycle xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx xx xxx xxxxx to xxx xxxxx xxxxxxxxxxxxxx xx xxxxx that xx xxxxxx require access.

Special xxxxxxxxx xxxxx xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxx criticality xxxx xxx abuse xx xxxxx access xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx the xxxxxxxxxx of xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx of xxxxxx xxxxxxxx, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx controls xxxxx xx xxx xx xxxxx xx identify, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx xx specific xxxxxx xx xxx xxxxxxxxxxxx’x network, e.g. xxx xxxxx xxx xxxxxx xxxxxx xx xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx accounts xxxxx xxx be shared xx xxxxx to xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx shall xx xxxxxxxxxxx xxx xxxxxxxx xx specific xxxxxxxx xx ensure xxxx xxxxxxxxx cannot xx xxxxxx guessed, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx xxxxxxxx. A safe xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx xxx xxxxxxxxxxx on xxx xxx xx xxxxxxxxxxxxx xxxxxxxx to protect xxx xxxxxxxxxxxxxxx, authenticity xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxx xxx of xxxxxxxxxxxxx controls.

There xxxxx xx xxxxxx xxx xxxxxxx confidential xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx policy) xx xxxxxx xxx risk xx unauthorised xxxxxx.

Xxxx xxxxxxx remotely, xxx xxxxx of xxxxxxx xx xx unprotected xxxxxxxxxxx xxxxx xx xxxxxxxxxx and appropriate xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxxxx xxx xxxxxx prior xx the xxxxxxxxxxx xxx/xx implementation xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx applications, xx xxxxxx correct xxxxxxxxxx. Xxxxx xxxxxxxx shall xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx be xxxxxxxx for systems xxxx xxxxxxx, or xxxx xx impact xx, xxxxxxxxx, xxxxxxxx xx critical information. Xxxx xxxxxxxx xxxxx xx determined xx xxx xxxxx of xxxxxxxx requirements xxx xxxx assessment xxxxxxxxx xx the xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx new xxxxxxx shall xx xxxxxxxxxxx, documented xxx xxxxxx xxxxx xx xxxxx xxxxxxxxxx xxx xxx. Xx xxxxxxx xxxxxxx security, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx xx implemented xxxxx xx xxx xxxxxxxxxxx of data xxxxx xxx xxx xxxxx xx xxxx xx xxx network xxxxx xx xxx xxxxxxxxxxxx. Xxxxx shall xx specific controls xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx to xxxxxx xxxxx and xxxxxxx source xxxx xxxxx be xxxxxxxxxx xxx XX xxxxxxxx xxx support xxxxxxxxxx xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Care xxxxx xx xxxxx xx xxxxx exposure xx xxxxxxxxx data xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx in xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. A risk assessment xx xxx xxxxx xxxxxxx to xx xxxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx testing xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx also xx conducted xxxxxxxxx xx a predefined plan xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, and xxxxxxxx xxxxxxx xxxxx include, xx least, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx shall xx xxxxxxxx and xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx shall be xxxxxxxx xxx xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx supplier (3) xxxxxxxxxxxxx

Xx xxxxxx protection xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxx, information xxxxxxxx xxxxxxxxxxxx for xxxxxxxxxx the xxxxx xxxxxxxxxx xxxx supplier’s xxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx xx the management xx information xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx events xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx xxx xxxxxxxxx level, shall xx established xxx xxxxxx to xxxxxx x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx xxx xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (e.g. x&xxxx;xxxxx pursued xx xx xxxxxxxx xxxxxxxx xx xx xx xxxxxxx). Xxxxxxxxx xxxxxxxx xx these xxxxxxxxxx xxxxx be adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx review

A participant’s xxxxxxxx xxxxxxxxxxx xxxxxxx (e.g. xxxx xxxxxx xxxxxxx, xxxxxxxx networks xxx xxxxxxxx network xxxxxxxxxxxx) xxxxx be regularly xxxxxxxx for xxxxxxxxxx xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (e.g. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx xxxxxx xxxx xxx xxx xxxxxxxx xxxxxxxx that are xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. hardening, logging). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx include: xxxxxxxxx xx the xxxxxxxxxx and xxx xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx patching, xxxxxx xxxxxxxxxx of different xxxxxxxxxxxx (x.x. production xxx development). Xxxxxxxxxxx xxxxxxxxxx, logging xxx xxxxxxxxxx as xxxx xx xxxxxxxx xx xxxxxx xxxxxx, xx xxxxxxxxxx for high xxxxxxxxxx xxxxxxxx, shall xx xxxxxxxxxxx xxxxx xx a risk xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx xx xxx xxxx xxxxxxxxxx xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx hybrid xxxxx solutions xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx be xxxxx on x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions xxx xxxx, xx is xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx xxx highest xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx hybrid solutions xxxx xx segregated xxxx xxx xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (applicable xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) relate xx business xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx xx xxxxx xxxxxxxx xxx xxx smooth xxxxxxxxxxx xx the XXXXXX2 xxxxxx shall have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx following elements.

Requirement 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx xxxx xxx xx xxxxx.
Xxxxxxxxxxx 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx site xxxxx xx available.
Requirement 2.3	:	Xxx risk xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx that xx the primary xxxx, xx xxxxx xx avoid xxxx xxxx xxxxx are xxxxxxxx by xxx xxxx xxxxx xx xxx same xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx xxxxx xx on x&xxxx;xxxxxxxxx xxxxx xxxx and xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those of xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx disruption xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx and/or xxxxxxxx xxxxx unavailable, xxx xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx to xxxxxx normal xxxxxxxxxx xxxx xxx alternate xxxx, xxxxx xx xxxxx xx possible xx xxxxxxxx close xxx business xxx xxx xxxx the xxxxxxxxx business day(s).
Requirement 2.5	:	Xxxxxxxxxx shall xx xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx resumed from xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx xxx xxxxxxx xxxxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx xx xxx business xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx critical xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx period between xxxxx shall not xxxxxx xxx xxxx.