Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx xxxxxxxxx xxxxxxxxxxx security xxxxxxxxxx xxx xxxxxxxx xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx xxxx participant, xxxxxx the xxxxxxxxxxx xxxxxxxxxxxx that a specific xxxxxxxxxxx xx xxx xxxxxxxxxx xx it. Xx xxxxxxxxxxxx xxx xxxxx xx application xx xxx requirements xxxxxx its xxxxxxxxxxxxxx, xxx xxxxxxxxxxx xxxxxx xxxxxxxx the elements xxxx are xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx (XXX). Xxxxxxxxxxxx, xxx XXX xxxxxx xx x&xxxx;Xxxxx xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx the creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx and xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx ends xx xxx xxxxxx xxxxxxxxxxx xx send the xxxxxxx to XXXXX (x.x. XXXXX XXX Xxx) xx Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Xxxxxxxx-xxxxx Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx management xxxxx xxx x&xxxx;xxxxx xxxxxx xxxxxxxxx in xxxx xxxx business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx and xxxxxxxxxx to information xxxxxxxx xxxxxxx xxx xxxxxxxx, xxxxxxxx xxx xxxxxxxxxxx of an xxxxxxxxxxx security xxxxxx xxxxxx xx xxxxxxxx xxxxxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx xxxxx of xxxxxxxxxxxxxx, xxxxxxxxxx and xxxxxxxxx xx information xxxxxxxx xxx cyber resilience xxxxx. Xxx xxxxxx xxxxxx xxxxxxx xx xxxxx xxx xxxxxxxxx xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx xxxxxxx xxxx xx organisation, human xxxxxxxxx, xxxxx xxxxxxxxxx xxx.), xxxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Internal xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx xx established xx xxxxxxxxx xxx xxxxxxxxxxx security xxxxxx xxxxxx xxx organisation. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx and xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx to ensure xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (xx per Xxxxxxxxxxx 1.1) across xxx organisation, including xxx xxxxxxxxxx xx xxxxxxxxxx xxxxxxxxx xxx xxxxxxxxxx xx xxxxxxxx xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx of xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx processing xxxxxxxxxx xxxxxx not xx xxxxxxx xx xxx xxxxxxxxxxxx of, xxx/xx the xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx them. Xxx access to xxx organisation’s information xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties shall xx xxxxxxxxxx. Xxxx xxxxxxxx xxxxxxx or xxxxxxxx/xxxxxxxx xx xxxxxxxx xxxxxxx are required xx xxxxxx the xxxxxxxxxxxx’x xxxxxxxxxxx processing xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx xx xxxxxxx xxx to determine xxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx xxx xxxxxxx xx an agreement xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx management

All xxxxxxxxxxx xxxxxx, the xxxxxxxx xxxxxxxxx xxx the xxxxxxxxxx information systems, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, business xxxxxxxxxxxx, off-the-shelf products, xxxxxxxx xxx xxxx-xxxxxxxxx xxxxxxxxxxxx, in the xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx xxxxxxxxx xxx xxx xxxx x&xxxx;xxxxxxxxx xxxxx. Xxx xxxxxxxxxxxxxx for the xxxxxxxxxxx and the xxxxxxxxx xx xxxxxxxxxxx xxxxxxxx in xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx safeguard xxx xxxxxxxxxxx xxxxxx xxxxx xx assigned. Xxxx: xxx xxxxx xxx xxxxxxxx xxx xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx remains accountable xxx the xxxxxx xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Information xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxx xx terms xx xxxxx criticality xx xxx xxxxxx xxxxxxxx xx the service xx xxx participant. Xxx classification xxxxx xxxxxxxx xxx need, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx required xxxx handling xxx xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX components. Xx xxxxxxxxxxx asset xxxxxxxxxxxxxx xxxxxx xxxxxxxx by xxx management xxxxx xx xxxx to xxxxxx xx appropriate xxx xx xxxxxxxxxx xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx asset xxxxxxxxx (xxxxxxxxx xxxxxxx and xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx the need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx security

Security xxxxxxxxxxxxxxxx xxxxx be xxxxxxxxx xxxxx xx xxxxxxxxxx xx adequate job xxxxxxxxxxxx xxx in xxxxx and conditions xx xxxxxxxxxx. Xxx xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx xxx third xxxxx users shall xx adequately xxxxxxxx, xxxxxxxxxx xxx xxxxxxxxx xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall xxxx xx xxxxxxxxx xx their security xxxxx and responsibilities. Xx xxxxxxxx level xx xxxxxxxxx xxxxx xx xxxxxxx xxxxx xxx employees, contractors xxx xxxxx xxxxx xxxxx, xxx education xxx xxxxxxxx in xxxxxxxx procedures xxx xxx xxxxxxx use xx xxxxxxxxxxx processing xxxxxxxxxx xxxxx xx xxxxxxxx xx xxxx xx xxxxxxxx xxxxxxxx xxxxxxxx xxxxx. A formal xxxxxxxxxxxx xxxxxxx for xxxxxxxx xxxxxxxx breaches xxxxx be established xxx xxxxxxxxx. Responsibilities xxxxx xx xx xxxxx xx ensure xxxx an xxxxxxxx’x, xxxxxxxxxx’x xx xxxxx xxxxx user’s xxxx xxxx xx xxxxxxxx xxxxxx xxx organisation xx xxxxxxx, and xxxx the return xx xxx equipment xxx the xxxxxxx xx all xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx shall be xxxxxx in xxxxxx xxxxx, protected xx xxxxxxx security perimeters, xxxx appropriate xxxxxxxx xxxxxxxx xxx xxxxx xxxxxxxx. Xxxx shall xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx xxx xxxxxxxxxxxx. Xxxxxx shall xx xxxxxxx xxxx xx xxxxxxxxxxx xxx xxxx xxxxxx xxx scope xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx established xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx when xx xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx of equipment (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) and xxxxxxx xxx xxxxxxx of xxxxxxxx xx necessary xx xxxxxx xxx xxxx of unauthorised xxxxxx xx xxxxxxxxxxx xxx to guard xxxxxxx loss xx xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx xxx xx xxxxxxxx to protect xxxxxxx xxxxxxxx xxxxxxx xxx xx xxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxx xx xxx electrical xxxxxx xxx xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx and xxxxxxxxxx xxxxx be established xxx xxx xxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx all the xxxxxxxxxx xxxxxxx in xxx Xxxxxxx Transaction Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, xxxxxxxxx xxxxxxxxx xxxxxxxxxxxxxx xx XX xxxxxxx, xxxxxxxxxxx xx xxxxxx xxxxx xx implemented, xxxxx xxxxxxxxxxx, to xxxxxx xxx xxxx xx xxxxxxxxx or xxxxxxxxxx xxxxxx misuse. Where xxxxxxxxxxx xx duties xxxxxx xx xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx following x&xxxx;xxxxxx xxxx analysis. Xxxxxxxx xxxxx xx xxxxxxxxxxx xx prevent xxx xxxxxx xxx introduction xx xxxxxxxxx xxxx xxx xxxxxxx xx xxx Payment Transaction Xxxxx. Xxxxxxxx xxxxx xx xxxx established (xxxxxxxxx xxxx xxxxxxxxx) xx prevent, xxxxxx xxx xxxxxx malicious xxxx. Xxxxxx code xxxxx be used xxxx xxxx xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX xxxxxxxxxx xxx Xxxx Applets). Xxx configuration of xxx browser (x.x. xxx use of xxxxxxxxxx and xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx backup and xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx by xxx xxxxxxxxxx; those xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx xx xxxxxx xx xxxxxxx intervals xx xxxxx xxxxxxxx.

Xxxxxxx xxxx are critical xxx xxx xxxxxxxx xx xxxxxxxx xxxxx xx xxxxxxxxx xxx xxxxxx relevant xx xxxxxxxxxxx xxxxxxxx shall xx xxxxxxxx. Operator xxxx xxxxx xx xxxx xx xxxxxx xxxx information xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxxxxxx xx a sample xxxxx, xxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. System monitoring xxxxx xx used xx xxxxx xxx xxxxxxxxxxxxx xx controls xxxxx are xxxxxxxxxx xx critical xxx xxx xxxxxxxx of xxxxxxxx and to xxxxxx xxxxxxxxxx xx xx xxxxxx xxxxxx xxxxx.

Xxxxxxxxx of xxxxxxxxxxx xxxxxxx xxxxxxxxxxxxx xxxxx xx based xx x&xxxx;xxxxxx exchange policy, xxxxxxx out xx xxxx with xxxxxxxx xxxxxxxxxx xxxxx the xxxxxxxx parties xxx xxxxx xx compliant xxxx any relevant xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxx xxxx XXXXXX2 (like xxxxxxxx xxxxxxxx from a Service Xxxxxx xx xxxxxxxx 2 xx xxx xxxxx xxxxxxx xx xxx TARGET2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxx xx xxx basis xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxxx of xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx xxxxxxxx policy). Xxxxx xxxxxx xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx xx xxx principle xx xxxxx xxxxxxxxx&xxxx;(2) to xxxxxxx xxxxxxx xxx xxxxx xx the xxxxxxxxxxxxx business and XX processes. Where xxxxxxxx (x.x. xxx xxxxxx xxxxxxxxxx) logical xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx with xxxxxxxx xxxxxx control xxxxxx xxxxx xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, personal data xxxxxxxxxxxxx).

Xxxxxx and documented xxxxxxxxxx xxxxx xx xx xxxxx to xxxxxxx xxx xxxxxxxxxx xx access xxxxxx xx information xxxxxxx xxx xxxxxxxx xxxx xxxx xxxxxx xxx xxxxx xx xxx Xxxxxxx Transaction Chain. Xxx xxxxxxxxxx shall xxxxx xxx xxxxxx xx xxx xxxxxxxxx xx user xxxxxx, xxxx xxx initial xxxxxxxxxxxx xx new xxxxx xx xxx xxxxx deregistration of xxxxx xxxx no xxxxxx xxxxxxx access.

Special xxxxxxxxx xxxxx xx xxxxx, xxxxx xxxxxxxxxxx, xx xxx xxxxxxxxxx xx xxxxxx xxxxxx xx xxxx criticality xxxx xxx xxxxx xx those xxxxxx xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx adverse xxxxxx xx xxx xxxxxxxxxx of the xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx system xxxxxxxxxxxxxx, xxxxxxxx of xxxxxx controls, direct xxxxxx to xxxxxxxx xxxx).

Xxxxxxxxxxx controls shall xx xxx xx xxxxx to xxxxxxxx, xxxxxxxxxxxx and xxxxxxxxx xxxxx xx xxxxxxxx xxxxxx in xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx xxxxx and xxxxxx xxxxxx to xxxxxxx xx the Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx xxxxxxxx shall xxx xx shared xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx be xxxxxxxxxxx xxx xxxxxxxx xx specific xxxxxxxx xx ensure that xxxxxxxxx xxxxxx be xxxxxx guessed, x.x. xxxxxxxxxx rules xxx xxxxxxx-xxxx xxxxxxxx. X&xxxx;xxxx xxxxxxxx recovery xxx/xx xxxxx xxxxxxxx shall xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx xxx xxxxxxxxxxx on xxx xxx of xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. A key xxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx controls.

There xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx print (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx policy) xx xxxxxx the xxxx xx xxxxxxxxxxxx access.

When xxxxxxx xxxxxxxx, xxx xxxxx xx xxxxxxx xx xx xxxxxxxxxxx xxxxxxxxxxx xxxxx be xxxxxxxxxx and appropriate xxxxxxxxx and xxxxxxxxxxxxxx xxxxxxxx xxxxx be xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx xx identified xxx agreed xxxxx xx the development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx systems.

Appropriate xxxxxxxx xxxxx xx built xxxx xxxxxxxxxxxx, xxxxxxxxx xxxx-xxxxxxxxx xxxxxxxxxxxx, xx xxxxxx xxxxxxx processing. Xxxxx xxxxxxxx shall xxxxxxx xxx xxxxxxxxxx xx input xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx data. Additional xxxxxxxx xxx xx xxxxxxxx xxx systems xxxx xxxxxxx, xx xxxx an xxxxxx xx, xxxxxxxxx, xxxxxxxx xx xxxxxxxx information. Xxxx controls xxxxx xx xxxxxxxxxx xx xxx basis xx xxxxxxxx xxxxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx policy).

The xxxxxxxxxxx xxxxxxxxxxxx of new xxxxxxx xxxxx xx xxxxxxxxxxx, documented and xxxxxx prior to xxxxx xxxxxxxxxx xxx xxx. As xxxxxxx xxxxxxx xxxxxxxx, xxxxxxxxxxx xxxxxxxx, including segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx xx implemented xxxxx on the xxxxxxxxxxx xx data xxxxx and xxx xxxxx xx xxxx xx the xxxxxxx xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx specific xxxxxxxx xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx over xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx files xxx xxxxxxx xxxxxx xxxx xxxxx xx controlled xxx XX projects xxx xxxxxxx xxxxxxxxxx xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Care xxxxx xx xxxxx xx xxxxx xxxxxxxx xx xxxxxxxxx xxxx xx xxxx environments. Xxxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. Deployment xx xxxxxxx in production xxxxx xx xxxxxxxx xxxxxxxxxx. A risk xxxxxxxxxx xx xxx xxxxx xxxxxxx to be xxxxxxxx in production xxxxx xx conducted.

Regular xxxxxxxx xxxxxxx xxxxxxxxxx xx systems xx xxxxxxxxxx xxxxx xxxx xx conducted xxxxxxxxx xx x&xxxx;xxxxxxxxxx plan xxxxx on the xxxxxxx xx x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx least, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx of xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx xxx security xxxxxxx xxxxxxxxxx shall xx xxxxxxxx xxx xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx xxxxx xx xxxxxxxx and followed xx xx a timely xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx protection xx the xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxx, information xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx the risks xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx xx xxxxxxxxxx xxx formally xxxxxx xxxx xxxx xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx xx xxxxxxxxxxx xxxxxxxx incidents xxx xxxxxxxxxxxx

Xx xxxxxx x&xxxx;xxxxxxxxxx xxx effective approach xx xxx management xx information xxxxxxxx xxxxxxxxx, including xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, roles, xxxxxxxxxxxxxxxx xxx xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx xxxxxxxxxxx xxx xxxxxx to xxxxxx x&xxxx;xxxxx, effective and xxxxxxx xxx xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx incidents including xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx pursued xx xx xxxxxxxx attacker xx xx xx xxxxxxx). Personnel xxxxxxxx xx xxxxx procedures xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (x.x. xxxx office systems, xxxxxxxx xxxxxxxx and xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx xxx xxxxxxxxxx xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxx xx xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx xxxxxxxx xxxxx xxxxxx xxxx xxx xxx security xxxxxxxx that xxx xxx for xxxxxxxx xxxxxxxx xxx systems (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx relating xx xxxxxxxxxxx xxxx include: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx operating xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. production xxx xxxxxxxxxxx). Xxxxxxxxxxx xxxxxxxxxx, logging xxx xxxxxxxxxx xx xxxx xx xxxxxxxx of xxxxxx xxxxxx, in xxxxxxxxxx xxx high xxxxxxxxxx xxxxxxxx, shall xx implemented xxxxx xx x&xxxx;xxxx assessment. Xxxxx virtual xxxxxxxx xxxxxxx xx xxx xxxx hypervisor xxxxx xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Xxxxx xxxxxxxxx

Xxx xxxxx xx xxxxxx xxx/xx hybrid xxxxx solutions xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx xx xxxxx on x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx xxx xxxxxxxxxxx xxxxx xx xxx xxxxxxx xxxxxx xx xxx highest xxx xx the xxxxxxxxx xxxxxxx. Xxx xx-xxxxxxxx xxxxxxxxxx of xxx xxxxxx xxxxxxxxx xxxx be segregated xxxx the other xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx critical xxxxxxxxxxxx)

Xxx xxxxxxxxx requirements (2.1 xx 2.6) relate xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx TARGET2 xxxxxxxxxxx xxxxxxxxxx by xxx Eurosystem as xxxxx critical xxx xxx xxxxxx xxxxxxxxxxx xx xxx TARGET2 xxxxxx xxxxx xxxx x&xxxx;xxxxxxxx continuity xxxxxxxx xx place comprising xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx xxxxxxxxx xxx xxxxxxxxxx xxx xxxxxxxxxxx them xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx xx xxxxxxxxx.
Xxxxxxxxxxx 2.3	:	Xxx risk xxxxxxx xx xxx xxxxxxxxx xxxx shall xx xxxxxxxxx xxxx xxxx xx xxx xxxxxxx xxxx, in order xx avoid xxxx xxxx sites xxx xxxxxxxx by xxx xxxx xxxxx xx xxx xxxx xxxx. Xxx xxxxxxx, the xxxxxxxxx xxxx xxxxx xx xx a different xxxxx grid xxx xxxxxxx xxxxxxxxxxxxxxxxx circuit xxxx those of xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx x&xxxx;xxxxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx xxxxxxx site xxxxxxxxxxxx xxx/xx critical xxxxx unavailable, xxx xxxxxxxx participant xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, where it xxxxx xx possible xx properly close xxx business xxx xxx xxxx xxx xxxxxxxxx business xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx shall be xx place xx xxxxxx xxxx the xxxxxxxxxx xx xxxxxxxxxxxx xx resumed xxxx xxx alternate site xxxxxx x&xxxx;xxxxxxxxxx timeframe xxxxx xxx xxxxxxx xxxxxxxxxx xx service xxx commensurate xx xxx criticality xx xxx business xxxx xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx xxxx xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx be xxxxxx xx xxxxx once x&xxxx;xxxx xxx xxxxxxxx xxxxx shall be xxxxxxxxxxxxx trained. The xxxxxxx period xxxxxxx xxxxx shall xxx xxxxxx one year.