Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx security xxxxxxxxxx xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx each participant, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx is not xxxxxxxxxx xx it. Xx xxxxxxxxxxxx xxx xxxxx of xxxxxxxxxxx xx xxx requirements xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx the elements xxxx xxx xxxx xx the Payment Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, xxx XXX xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. a system involved xx xxx xxxxxxxx xx transactions (x.x. xxxxxxxxxxxx, front-office and xxxx-xxxxxx applications, middleware), xxx xxxx at xxx xxxxxx xxxxxxxxxxx xx xxxx xxx xxxxxxx to XXXXX (x.x. XXXXX VPN Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx xxx x&xxxx;xxxxx xxxxxx direction in xxxx xxxx xxxxxxxx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx xx information xxxxxxxx xxxxxxx xxx xxxxxxxx, approval xxx xxxxxxxxxxx xx xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx managing xxxxxxxxxxx security xxx xxxxx resilience across xxx xxxxxxxxxxxx in xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx and xxxxxxxxx xx information security xxx cyber resilience xxxxx. Xxx policy xxxxxx xxxxxxx at xxxxx xxx following xxxxxxxx: xxxxxxxxxx, scope (xxxxxxxxx domains such xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, xxxxx management xxx.), xxxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx security xxxxxxxxx xxxxx xx established xx xxxxxxxxx the xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx organisation. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx per Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x information xxx xxxxxxxxxxx processing xxxxxxxxxx xxxxxx not xx xxxxxxx xx xxx introduction xx, xxx/xx xxx xxxxxxxxxx xx, an xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx by xxxx. Xxx xxxxxx to xxx organisation’s xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx by xxxxxxxx xxxxxxx xxxxx xx controlled. Xxxx xxxxxxxx xxxxxxx xx xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx xxx required xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be xxxxxxx xxx xx xxxxxxxxx xxx xxxxxxxx implications xxx control xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx xxx xxxxxxx xx xx agreement xxxx xxxx relevant xxxxxxxx party.

Requirement 1.4: Xxxxx management

All information xxxxxx, xxx business xxxxxxxxx and the xxxxxxxxxx information xxxxxxx, xxxx xx operating xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, off-the-shelf products, xxxxxxxx and xxxx-xxxxxxxxx xxxxxxxxxxxx, in the xxxxx of the Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx xxxxxxxxx xxx xxx have x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx for xxx xxxxxxxxxxx and the xxxxxxxxx of xxxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx safeguard xxx information assets xxxxx xx xxxxxxxx. Xxxx: the owner xxx xxxxxxxx the xxxxxxxxxxxxxx of specific xxxxxxxx xx appropriate, xxx xxxxxxx xxxxxxxxxxx xxx xxx xxxxxx xxxxxxxxxx of the xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx classification

Information assets xxxxx be xxxxxxxxxx xx terms xx xxxxx xxxxxxxxxxx to xxx xxxxxx delivery xx xxx xxxxxxx xx xxx participant. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx xxxx, xxxxxxxxxx and xxxxxx xx xxxxxxxxxx required xxxx handling the xxxxxxxxxxx asset xx xxx relevant business xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx underlying XX components. Xx xxxxxxxxxxx xxxxx classification xxxxxx approved by xxx xxxxxxxxxx shall xx xxxx xx xxxxxx an xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxx throughout the xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx xx information xxxxxx) and xx xxxxxxxxxxx xxx xxxx xxx xxxxxxxx handling xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx security

Security responsibilities xxxxx xx xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx xxx xxxxxxxxxxxx xxx xx xxxxx and conditions xx xxxxxxxxxx. All xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx and xxxxx xxxxx users xxxxx xx adequately xxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, contractors xxx xxxxx xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxx xxxx xx agreement xx xxxxx xxxxxxxx xxxxx xxx responsibilities. Xx xxxxxxxx level xx xxxxxxxxx shall xx xxxxxxx xxxxx xxx xxxxxxxxx, xxxxxxxxxxx xxx xxxxx party xxxxx, and xxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxxxx xxx xxx correct xxx xx xxxxxxxxxxx processing xxxxxxxxxx xxxxx xx xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx. A formal xxxxxxxxxxxx process xxx xxxxxxxx xxxxxxxx breaches xxxxx xx xxxxxxxxxxx xxx employees. Xxxxxxxxxxxxxxxx xxxxx xx in xxxxx xx xxxxxx xxxx an employee’s, xxxxxxxxxx’x xx third xxxxx xxxx’x xxxx xxxx or transfer xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, and xxxx the xxxxxx xx xxx xxxxxxxxx xxx the xxxxxxx xx all access xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx or xxxxxxxxx xxxxxxxxxxx processing xxxxxxxxxx xxxxx be xxxxxx in secure xxxxx, protected by xxxxxxx xxxxxxxx xxxxxxxxxx, xxxx appropriate xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. They shall xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx and interference. Xxxxxx xxxxx xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx xxxxx xx Requirement 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx shall xx xxxxxxxxx xxxx physical xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) xxx against xxx xxxxxxx xx xxxxxxxx xx necessary xx xxxxxx the xxxx of xxxxxxxxxxxx xxxxxx xx xxxxxxxxxxx xxx xx xxxxx xxxxxxx xxxx or xxxxxx xx equipment xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx to protect xxxxxxx xxxxxxxx xxxxxxx xxx xx safeguard xxxxxxxxxx xxxxxxxxxx xxxx xx xxx xxxxxxxxxx xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx established xxx xxx xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx systems xx xxx Payment Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx regards xxxxxxxxx procedures, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, segregation xx xxxxxx xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx xxxxxx xxx risk xx xxxxxxxxx xx xxxxxxxxxx xxxxxx xxxxxx. Xxxxx xxxxxxxxxxx xx xxxxxx xxxxxx be xxxxxxxxxxx xxx to documented xxxxxxxxx xxxxxxx, compensatory xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx analysis. Xxxxxxxx xxxxx be xxxxxxxxxxx xx prevent xxx xxxxxx xxx introduction xx xxxxxxxxx xxxx xxx systems xx xxx Payment Xxxxxxxxxxx Xxxxx. Controls xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx user awareness) xx xxxxxxx, xxxxxx xxx remove xxxxxxxxx xxxx. Mobile xxxx xxxxx be xxxx xxxx from xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Applets). Xxx configuration xx xxx browser (x.x. xxx use xx xxxxxxxxxx xxx plugins) xxxxx be strictly xxxxxxxxxx.

Xxxx backup xxx xxxxxxxx policies xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx regular xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx xxx xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx shall xx monitored and xxxxxx xxxxxxxx xx xxxxxxxxxxx security xxxxx xx recorded. Operator xxxx xxxxx xx xxxx xx ensure xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx reviewed xx x&xxxx;xxxxxx basis, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. System xxxxxxxxxx xxxxx xx xxxx xx xxxxx xxx xxxxxxxxxxxxx xx controls xxxxx xxx xxxxxxxxxx xx critical for xxx xxxxxxxx of xxxxxxxx and xx xxxxxx xxxxxxxxxx xx xx xxxxxx policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx shall xx xxxxx on x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out xx xxxx xxxx exchange xxxxxxxxxx xxxxx xxx xxxxxxxx xxxxxxx xxx xxxxx xx compliant xxxx xxx relevant xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx information with XXXXXX2 (xxxx software xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx in scenario 2 xx xxx xxxxx xxxxxxx xx xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx with xxx third xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx control

Access xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) and xxxxxxxxx xx the established xxxxxxxxx xx xxxxxxxxx xxxxxxxx (including xxx xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx xxxxxx control xxxxx xxxxx xx xxxxxxx xxxxx xx xxx principle of xxxxx xxxxxxxxx&xxxx;(2) xx xxxxxxx xxxxxxx the xxxxx xx the xxxxxxxxxxxxx xxxxxxxx and XX xxxxxxxxx. Where xxxxxxxx (x.x. for xxxxxx management) xxxxxxx xxxxxx xxxxxxx xxxxxx xx consistent with xxxxxxxx access xxxxxxx xxxxxx xxxxx are xxxxxxxx xxxxxxxxxxxx controls xx place (x.x. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxxx xxx xxxxxxxxxx xx access xxxxxx xx xxxxxxxxxxx xxxxxxx xxx services xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx stages xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx xxx initial xxxxxxxxxxxx xx xxx xxxxx to xxx xxxxx xxxxxxxxxxxxxx of xxxxx xxxx xx xxxxxx xxxxxxx xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx xx xxxxx, where appropriate, xx the xxxxxxxxxx xx access xxxxxx xx such xxxxxxxxxxx xxxx the abuse xx xxxxx access xxxxxx xxxxx lead xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx allowing xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx xxxxxxxx, direct xxxxxx to business xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx put xx xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx authorise xxxxx xx specific xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local and xxxxxx access xx xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx xxxxx to xxxxxx accountability.

For xxxxxxxxx, xxxxx shall be xxxxxxxxxxx xxx enforced xx xxxxxxxx xxxxxxxx xx xxxxxx xxxx xxxxxxxxx xxxxxx xx xxxxxx xxxxxxx, e.g. xxxxxxxxxx xxxxx and xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx xxx xxxxxxxxxxx xx xxx xxx of cryptographic xxxxxxxx to xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx xx xxxxxxxxxxx to xxxxxxx xxx use of xxxxxxxxxxxxx controls.

There xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx screen or xx xxxxx (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx xxx xxxx xx unauthorised xxxxxx.

Xxxx xxxxxxx xxxxxxxx, xxx xxxxx of working xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx and xxxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx xxxxxxxxxxx, development xxx maintenance

Security xxxxxxxxxxxx xxxxx xx identified xxx xxxxxx xxxxx xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be xxxxx xxxx xxxxxxxxxxxx, including xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx correct xxxxxxxxxx. Xxxxx controls shall xxxxxxx xxx xxxxxxxxxx xx xxxxx data, xxxxxxxx xxxxxxxxxx and xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx xxxxxxx, or xxxx an impact xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx controls xxxxx xx xxxxxxxxxx on xxx basis xx xxxxxxxx xxxxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxxx xx xxx established xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx operational xxxxxxxxxxxx xx xxx xxxxxxx xxxxx xx xxxxxxxxxxx, xxxxxxxxxx and xxxxxx prior to xxxxx xxxxxxxxxx and xxx. Xx xxxxxxx xxxxxxx security, appropriate xxxxxxxx, including xxxxxxxxxxxx xxx xxxxxx management, xxxxxx xx implemented xxxxx xx xxx xxxxxxxxxxx xx data xxxxx xxx the xxxxx xx risk xx xxx xxxxxxx xxxxx xx the xxxxxxxxxxxx. Xxxxx shall xx xxxxxxxx xxxxxxxx xx xxxxxxx sensitive xxxxxxxxxxx xxxxxxx xxxx xxxxxx networks.

Access xx xxxxxx xxxxx xxx xxxxxxx xxxxxx code xxxxx xx xxxxxxxxxx xxx XX projects xxx xxxxxxx activities xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Xxxx xxxxx xx taken xx xxxxx exposure xx xxxxxxxxx data in xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx be xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx xxxxx xxxxxxx xx xx xxxxxxxx xx xxxxxxxxxx xxxxx xx conducted.

Regular xxxxxxxx xxxxxxx activities xx systems xx xxxxxxxxxx xxxxx also xx conducted xxxxxxxxx xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx xxx xxxxxxx xx a risk xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx least, vulnerability xxxxxxxxxxx. All of xxx shortcomings highlighted xxxxxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx assessed xxx xxxxxx xxxxx xx xxxxx xxx identified xxx xxxxx xx xxxxxxxx xxx xxxxxxxx xx xx x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx protection xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx accessible xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx requirements for xxxxxxxxxx the xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx shall xx xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx xxxx xxx supplier.

Requirement 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx and xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx xx xxx management xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx weaknesses, roles, xxxxxxxxxxxxxxxx xxx procedures, xx business and xxxxxxxxx level, xxxxx xx established xxx xxxxxx to ensure x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx xxx xxxxxx xxxxxxx from information xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx xxxxxxxx xx xx xx xxxxxxx). Personnel involved xx xxxxx xxxxxxxxxx xxxxx xx adequately xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (e.g. xxxx xxxxxx systems, xxxxxxxx networks xxx xxxxxxxx network xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx xxxxxxxxx of xxxxxxxx (x.x. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx comply xxxx xxx the xxxxxxxx xxxxxxxx xxxx xxx xxx for xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. hardening, xxxxxxx). Xxxxxxxx xxxxxxxx xx xxxxxxxxxxx xxxx include: xxxxxxxxx xx xxx xxxxxxxxxx xxx the xxxxxxx xxxxxxxxx xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, logging xxx xxxxxxxxxx as well xx xxxxxxxx of xxxxxx xxxxxx, in xxxxxxxxxx xxx xxxx xxxxxxxxxx accounts, shall xx xxxxxxxxxxx based xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx machines xxxxxxx xx xxx xxxx hypervisor xxxxx xxxx x&xxxx;xxxxxxx risk xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx usage of xxxxxx and/or xxxxxx xxxxx solutions xx xxx Xxxxxxx Transaction Xxxxx xxxx be xxxxx xx a formal xxxx assessment, xxxxxx xxxx account xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx clauses xxxxxxx to xxx xxxxx xxxxxxxx.

Xx xxxxxx xxxxx solutions xxx xxxx, it xx xxxxxxxxxx that the xxxxxxxxxxx xxxxx xx xxx xxxxxxx system xx xxx highest xxx of the xxxxxxxxx xxxxxxx. All xx-xxxxxxxx components of xxx hybrid xxxxxxxxx xxxx xx xxxxxxxxxx xxxx the xxxxx xx-xxxxxxxx xxxxxxx.

Xxxxxxxx xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx xxxxxxxxxxxx)

Xxx xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx continuity xxxxxxxxxx. Each XXXXXX2 xxxxxxxxxxx xxxxxxxxxx xx xxx Xxxxxxxxxx xx xxxxx xxxxxxxx xxx xxx xxxxxx xxxxxxxxxxx xx xxx XXXXXX2 xxxxxx shall have x&xxxx;xxxxxxxx xxxxxxxxxx strategy xx xxxxx xxxxxxxxxx xxx xxxxxxxxx elements.

Requirement 2.1	:	Xxxxxxxx continuity xxxxx xxxxx be developed xxx xxxxxxxxxx xxx xxxxxxxxxxx them are xx place.
Requirement 2.2	:	An xxxxxxxxx xxxxxxxxxxx site xxxxx be available.
Requirement 2.3	:	Xxx risk xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx from that xx the xxxxxxx xxxx, xx xxxxx xx xxxxx xxxx xxxx xxxxx xxx xxxxxxxx xx xxx xxxx xxxxx xx xxx xxxx xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx shall xx xx a different xxxxx xxxx xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx xxxxxxx xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	Xx xxx xxxxx xx a major xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx unavailable, the xxxxxxxx xxxxxxxxxxx shall xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx xx xxxxx be xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx xxx xxx xxxx xxx xxxxxxxxx business xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall xx xx xxxxx xx xxxxxx that xxx xxxxxxxxxx xx xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx site xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx xxx xxxxxxx xxxxxxxxxx of service xxx xxxxxxxxxxxx xx xxx criticality xx xxx xxxxxxxx xxxx xxx disrupted.
Requirement 2.6	:	The xxxxxxx xx xxxx xxxx operational xxxxxxxxxxx xxxxx xx tested xx xxxxx xxxx x&xxxx;xxxx and critical xxxxx shall be xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx period xxxxxxx xxxxx xxxxx xxx xxxxxx xxx xxxx.