Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx xxxxxxxx xxxxxxxxxx xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx each xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx a specific xxxxxxxxxxx xx xxx xxxxxxxxxx to it. Xx xxxxxxxxxxxx xxx xxxxx of xxxxxxxxxxx xx the xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the elements xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, the PTC xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (PoE), x.x. x&xxxx;xxxxxx involved xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, front-office xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx xx xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx xx SWIFT (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set a clear xxxxxx xxxxxxxxx in xxxx xxxx xxxxxxxx xxxxxxxxxx and xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxx the xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx of xx xxxxxxxxxxx security policy xxxxxx at xxxxxxxx xxxxxxxxxxx xxxxxxxx and xxxxx xxxxxxxxxx across xxx xxxxxxxxxxxx xx xxxxx of identification, xxxxxxxxxx and xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxx cyber xxxxxxxxxx xxxxx. The xxxxxx xxxxxx contain xx xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, scope (xxxxxxxxx xxxxxxx such xx organisation, xxxxx xxxxxxxxx, xxxxx management xxx.), principles and xxxxxxxxxx xx responsibilities.

Requirement 1.2: Xxxxxxxx organisation

An xxxxxxxxxxx xxxxxxxx framework xxxxx xx xxxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx security policy xxxxxx xxx xxxxxxxxxxxx. Xxx management xxxxx xxxxxxxxxx xxx review xxx xxxxxxxxxxxxx of xxx information security xxxxxxxxx to ensure xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx security xxxxxx (as xxx Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx and xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx for xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: Xxxxxxxx xxxxxxx

Xxx security of xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx information xxxxxxxxxx xxxxxxxxxx xxxxxx not xx reduced xx xxx introduction of, xxx/xx xxx dependence xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx by xxxx. Xxx xxxxxx xx xxx xxxxxxxxxxxx’x information xxxxxxxxxx facilities xx xxxxxxxx xxxxxxx shall xx controlled. Xxxx xxxxxxxx parties xx xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx are required xx access xxx xxxxxxxxxxxx’x xxxxxxxxxxx processing xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx to xxxxxxxxx xxx xxxxxxxx implications xxx xxxxxxx requirements. Xxxxxxxx shall xx xxxxxx and xxxxxxx xx an xxxxxxxxx xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx management

All xxxxxxxxxxx xxxxxx, xxx xxxxxxxx xxxxxxxxx and xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx operating xxxxxxx, xxxxxxxxxxxxxxx, xxxxxxxx xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, in xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx xxxxxxxxx xxx and xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx for xxx xxxxxxxxxxx and xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxx. Xxxx: the owner xxx delegate xxx xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx as appropriate, xxx xxxxxxx xxxxxxxxxxx xxx the xxxxxx xxxxxxxxxx of xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx assets xxxxx xx classified xx xxxxx of xxxxx xxxxxxxxxxx to xxx smooth xxxxxxxx xx xxx xxxxxxx xx the xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx need, xxxxxxxxxx xxx xxxxxx xx protection xxxxxxxx xxxx xxxxxxxx the xxxxxxxxxxx xxxxx xx xxx relevant xxxxxxxx xxxxxxxxx xxx xxxxx xxxx take into xxxxxxxxxxxxx the xxxxxxxxxx XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx an appropriate xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx removal xxx xxxxxxxxxxx xx information xxxxxx) xxx to xxxxxxxxxxx the xxxx xxx xxxxxxxx handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx security

Security xxxxxxxxxxxxxxxx xxxxx be addressed xxxxx to xxxxxxxxxx xx adequate xxx xxxxxxxxxxxx and xx xxxxx xxx xxxxxxxxxx xx employment. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx xxx third xxxxx users xxxxx xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx xxx sensitive xxxx. Xxxxxxxxx, contractors xxx third xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx facilities xxxxx xxxx xx xxxxxxxxx xx xxxxx xxxxxxxx xxxxx xxx xxxxxxxxxxxxxxxx. Xx adequate xxxxx xx xxxxxxxxx xxxxx xx ensured xxxxx xxx employees, xxxxxxxxxxx xxx xxxxx party xxxxx, xxx education xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx and xxx xxxxxxx xxx xx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx to xxxx xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx process xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx xx xx xxxxx to ensure xxxx xx xxxxxxxx’x, xxxxxxxxxx’x or xxxxx xxxxx user’s exit xxxx xx transfer xxxxxx the organisation xx xxxxxxx, xxx xxxx xxx xxxxxx xx xxx equipment xxx xxx xxxxxxx xx xxx xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Physical xxx xxxxxxxxxxxxx security

Critical xx xxxxxxxxx xxxxxxxxxxx processing xxxxxxxxxx xxxxx xx xxxxxx xx secure xxxxx, protected xx xxxxxxx xxxxxxxx perimeters, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx and xxxxx xxxxxxxx. They xxxxx xx xxxxxxxxxx xxxxxxxxx xxxx unauthorised access, xxxxxx and interference. Xxxxxx xxxxx xx xxxxxxx xxxx to xxxxxxxxxxx who xxxx xxxxxx the scope xx Requirement 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx xx established xx xxxxxxx xxxxxxxx xxxxx containing information xxxxxx when in xxxxxxx.

Xxxxxxxxx shall xx xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx equipment xxxx xxx-xxxx) xxx xxxxxxx xxx xxxxxxx xx xxxxxxxx is necessary xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx to xxxxxxxxxxx xxx xx xxxxx xxxxxxx loss xx xxxxxx of xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx to xxxxxxx xxxxxxx xxxxxxxx xxxxxxx xxx to xxxxxxxxx xxxxxxxxxx xxxxxxxxxx such xx xxx electrical xxxxxx and xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx procedures xxxxx be xxxxxxxxxxx xxx the management xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx the xxxxxxxxxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx xxxxxx xxxxx xx xxxxxxxxxxx, where xxxxxxxxxxx, xx reduce xxx risk xx xxxxxxxxx or xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx xx implemented xxx xx xxxxxxxxxx xxxxxxxxx reasons, compensatory xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx a formal xxxx xxxxxxxx. Xxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxxxxx xxx xxxxxxxxxxxx xx malicious code xxx systems in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx also established (xxxxxxxxx user xxxxxxxxx) xx prevent, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx code xxxxx xx xxxx xxxx from xxxxxxx xxxxxxx (e.g. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx xxxxxxxxxxxxx xx xxx xxxxxxx (x.x. xxx xxx xx xxxxxxxxxx and plugins) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx backup and xxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx xx xxx management; xxxxx xxxxxxxx policies xxxxx xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular intervals xx least xxxxxxxx.

Xxxxxxx xxxx are xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx shall xx monitored and xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx shall xx recorded. Operator xxxx xxxxx xx xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx identified. Xxxxxxxx logs shall xx regularly xxxxxxxx xx a sample xxxxx, xxxxx xx xxx xxxxxxxxxxx of the xxxxxxxxxx. System monitoring xxxxx xx xxxx xx check the xxxxxxxxxxxxx xx controls xxxxx xxx identified xx xxxxxxxx for xxx security xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx access xxxxxx xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx xxxxx xx based xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx xxx xx xxxx xxxx xxxxxxxx xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx compliant xxxx any relevant xxxxxxxxxxx. Xxxxx party xxxxxxxx xxxxxxxxxx xxxxxxxx xx the xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (xxxx xxxxxxxx xxxxxxxx from x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 of xxx xxxxx xxxxxxx of xxx TARGET2 self-certification xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx agreement xxxx xxx third xxxxx.

Xxxxxxxxxxx 1.9: Access xxxxxxx

Xxxxxx xx xxxxxxxxxxx xxxxxx xxxxx xx justified xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx according xx xxx xxxxxxxxxxx xxxxxxxxx of corporate xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx access xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx on xxx principle of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx closely the xxxxx xx the xxxxxxxxxxxxx business xxx XX processes. Xxxxx xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx control xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (e.g. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx and xxxxxxxxxx xxxxxxxxxx shall be xx xxxxx to xxxxxxx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx information xxxxxxx xxx xxxxxxxx xxxx xxxx within xxx xxxxx of xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx procedures xxxxx xxxxx all xxxxxx xx xxx lifecycle xx xxxx xxxxxx, xxxx xxx initial xxxxxxxxxxxx of xxx xxxxx to the xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx xx xxxxxx require xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx xx xxxxx, where xxxxxxxxxxx, xx the xxxxxxxxxx xx access xxxxxx xx xxxx criticality xxxx the abuse xx those access xxxxxx could xxxx xx x&xxxx;xxxxxx adverse xxxxxx on xxx xxxxxxxxxx of xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, override xx xxxxxx xxxxxxxx, direct xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx controls xxxxx xx xxx xx xxxxx xx identify, xxxxxxxxxxxx and authorise xxxxx xx specific xxxxxx in the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx xxxxx and xxxxxx xxxxxx xx xxxxxxx xx xxx Xxxxxxx Transaction Chain. Xxxxxxxx xxxxxxxx xxxxx xxx be xxxxxx xx xxxxx xx xxxxxx accountability.

For xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx and enforced xx xxxxxxxx xxxxxxxx xx xxxxxx xxxx xxxxxxxxx xxxxxx be xxxxxx xxxxxxx, x.x. xxxxxxxxxx xxxxx xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx recovery xxx/xx xxxxx protocol shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx xxxxx xx developed xxx xxxxxxxxxxx xx xxx xxx of cryptographic xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx integrity xx xxxxxxxxxxx. A key management xxxxxx xxxxx xx xxxxxxxxxxx to xxxxxxx xxx xxx xx xxxxxxxxxxxxx controls.

There xxxxx xx policy xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx the xxxx xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx xx xxxxxxx xx an unprotected xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx appropriate xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx maintenance

Security requirements xxxxx be xxxxxxxxxx xxx xxxxxx xxxxx xx xxx xxxxxxxxxxx xxx/xx implementation of xxxxxxxxxxx systems.

Appropriate xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, to xxxxxx correct processing. Xxxxx controls shall xxxxxxx xxx validation xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx process, xx xxxx xx xxxxxx xx, xxxxxxxxx, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx controls xxxxx xx determined xx xxx xxxxx of xxxxxxxx xxxxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx policy).

The xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, documented xxx xxxxxx prior xx xxxxx xxxxxxxxxx xxx xxx. As xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, including xxxxxxxxxxxx xxx secure management, xxxxxx xx implemented xxxxx xx the xxxxxxxxxxx xx data xxxxx xxx the xxxxx xx risk xx the xxxxxxx xxxxx in xxx xxxxxxxxxxxx. There xxxxx xx xxxxxxxx xxxxxxxx xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx to xxxxxx xxxxx xxx xxxxxxx xxxxxx xxxx xxxxx xx controlled xxx XX xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx xxxxx xx xxxxx xxxxxxxx xx xxxxxxxxx data xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx be xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx in xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. A risk assessment xx xxx major xxxxxxx to be xxxxxxxx xx production xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx activities xx xxxxxxx xx xxxxxxxxxx shall also xx xxxxxxxxx according xx a predefined xxxx xxxxx xx xxx xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx shall xxxxxxx, xx xxxxx, vulnerability xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx highlighted xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx assessed and xxxxxx xxxxx to xxxxx any xxxxxxxxxx xxx shall be xxxxxxxx xxx followed xx in a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems xxxx xxx accessible xx suppliers, information xxxxxxxx requirements xxx xxxxxxxxxx the risks xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx xx xxxxxxxxxx and xxxxxxxx xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx incidents and xxxxxxxxxxxx

Xx xxxxxx a consistent xxx effective approach xx the xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx security events xxx weaknesses, xxxxx, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx business xxx xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, xxxxxxxxx xxx xxxxxxx and xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx xx xx external xxxxxxxx xx xx an xxxxxxx). Xxxxxxxxx xxxxxxxx xx xxxxx procedures xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx (x.x. xxxx xxxxxx xxxxxxx, xxxxxxxx xxxxxxxx and xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx xxx compliance xxxx xxx organisation’s xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (e.g. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx policy).

Requirement 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx xxx xxxxxxxx xxxxxxxx that xxx xxx for xxxxxxxx xxxxxxxx xxx systems (x.x. xxxxxxxxx, logging). Xxxxxxxx relating to xxxxxxxxxxx xxxx include: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx xxxxxxxxx system, xxxxxxx patching, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (e.g. production xxx xxxxxxxxxxx). Centralised xxxxxxxxxx, logging xxx xxxxxxxxxx as well xx xxxxxxxx of xxxxxx xxxxxx, xx xxxxxxxxxx for xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx xxxxx xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx the xxxx xxxxxxxxxx shall xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx of xxxxxx xxx/xx xxxxxx xxxxx xxxxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx xx xxxxx on x&xxxx;xxxxxx xxxx assessment, taking xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx level of xxx xxxxxxx xxxxxx xx the highest xxx xx xxx xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx components xx xxx xxxxxx xxxxxxxxx xxxx be xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (applicable xxxx xx critical xxxxxxxxxxxx)

Xxx xxxxxxxxx requirements (2.1 xx 2.6) xxxxxx xx business xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx classified by xxx Xxxxxxxxxx xx xxxxx critical xxx xxx xxxxxx xxxxxxxxxxx xx the XXXXXX2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx be xxxxxxxxx xxx xxxxxxxxxx for xxxxxxxxxxx them xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx xxxxxxxxxxx xxxx xxxxx be xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx risk xxxxxxx xx xxx alternate xxxx shall be xxxxxxxxx xxxx xxxx xx the xxxxxxx xxxx, xx xxxxx xx avoid xxxx xxxx xxxxx are xxxxxxxx xx xxx xxxx event xx xxx same time. Xxx xxxxxxx, the xxxxxxxxx xxxx xxxxx xx on a different xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx xxxxxxx business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, xxx xxxxxxxx xxxxxxxxxxx shall xx able xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, where it xxxxx be xxxxxxxx xx xxxxxxxx close xxx business day xxx open xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx be xx place xx xxxxxx xxxx xxx xxxxxxxxxx of xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx xxxx xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx xx service xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxx xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx disruptions xxxxx xx xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx be xxxxxxxxxxxxx xxxxxxx. The xxxxxxx period xxxxxxx xxxxx xxxxx xxx xxxxxx xxx xxxx.