Plné znění - 32021D1758

„Xxxxxxxx XXX

Xxxxxxxxxxxx regarding xxxxxxxxxxx xxxxxxxx management xxx business xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxx security xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx applicable xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx xx xx. Xx establishing xxx xxxxx xx xxxxxxxxxxx xx xxx requirements xxxxxx xxx infrastructure, xxx participant xxxxxx xxxxxxxx the elements xxxx xxx xxxx xx xxx Payment Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, xxx PTC xxxxxx xx a Point xx Xxxxx (XxX), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx creation xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, xxxxx-xxxxxx xxx xxxx-xxxxxx xxxxxxxxxxxx, middleware), xxx ends xx xxx xxxxxx responsible xx send the xxxxxxx xx XXXXX (x.x. XXXXX VPN Xxx) xx Internet (xxxx xxx xxxxxx xxxxxxxxxx to Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Information xxxxxxxx xxxxxx

Xxx xxxxxxxxxx xxxxx set x&xxxx;xxxxx xxxxxx xxxxxxxxx xx xxxx with business xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxx xxx xxx xxxxxxxxxx to xxxxxxxxxxx xxxxxxxx xxxxxxx xxx xxxxxxxx, approval xxx xxxxxxxxxxx of xx xxxxxxxxxxx xxxxxxxx policy xxxxxx xx xxxxxxxx xxxxxxxxxxx security xxx xxxxx resilience across xxx organisation xx xxxxx xx xxxxxxxxxxxxxx, xxxxxxxxxx xxx treatment xx information security xxx xxxxx resilience xxxxx. Xxx policy xxxxxx xxxxxxx xx xxxxx the following xxxxxxxx: xxxxxxxxxx, xxxxx (xxxxxxxxx domains xxxx xx xxxxxxxxxxxx, xxxxx xxxxxxxxx, asset management xxx.), principles xxx xxxxxxxxxx xx xxxxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx security framework xxxxx be xxxxxxxxxxx xx implement the xxxxxxxxxxx xxxxxxxx xxxxxx xxxxxx xxx xxxxxxxxxxxx. Xxx xxxxxxxxxx xxxxx xxxxxxxxxx xxx xxxxxx xxx establishment xx xxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xx xxxxxx xxx xxxxxxxxxxxxxx of xxx information security xxxxxx (as per Xxxxxxxxxxx 1.1) xxxxxx xxx xxxxxxxxxxxx, xxxxxxxxx xxx xxxxxxxxxx of xxxxxxxxxx resources xxx xxxxxxxxxx of security xxxxxxxxxxxxxxxx xxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx not xx xxxxxxx xx xxx introduction of, xxx/xx the xxxxxxxxxx xx, xx xxxxxxxx xxxxx/xxxxxxx or products/services xxxxxxxx xx xxxx. Xxx xxxxxx xx xxx organisation’s information xxxxxxxxxx facilities xx xxxxxxxx xxxxxxx xxxxx xx xxxxxxxxxx. Xxxx xxxxxxxx parties xx xxxxxxxx/xxxxxxxx of xxxxxxxx xxxxxxx are xxxxxxxx xx access the xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx xx xxxxxxx xxx xx xxxxxxxxx xxx xxxxxxxx implications xxx xxxxxxx xxxxxxxxxxxx. Xxxxxxxx xxxxx xx xxxxxx and defined xx xx agreement xxxx xxxx xxxxxxxx xxxxxxxx party.

Requirement 1.4: Xxxxx xxxxxxxxxx

Xxx xxxxxxxxxxx xxxxxx, the xxxxxxxx xxxxxxxxx xxx the xxxxxxxxxx xxxxxxxxxxx systems, xxxx xx xxxxxxxxx xxxxxxx, infrastructures, xxxxxxxx xxxxxxxxxxxx, off-the-shelf xxxxxxxx, xxxxxxxx xxx user-developed xxxxxxxxxxxx, xx xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx xx accounted xxx and xxxx x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx xxx the xxxxxxxxxxx xxx the xxxxxxxxx of xxxxxxxxxxx xxxxxxxx xx the xxxxxxxx xxxxxxxxx and xxx xxxxxxx XX xxxxxxxxxx xx safeguard xxx information xxxxxx xxxxx be xxxxxxxx. Xxxx: xxx owner xxx xxxxxxxx xxx xxxxxxxxxxxxxx of xxxxxxxx xxxxxxxx xx xxxxxxxxxxx, xxx xxxxxxx xxxxxxxxxxx xxx the xxxxxx xxxxxxxxxx xx xxx xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx be xxxxxxxxxx xx terms xx xxxxx xxxxxxxxxxx xx xxx xxxxxx xxxxxxxx xx the xxxxxxx xx xxx xxxxxxxxxxx. Xxx xxxxxxxxxxxxxx shall xxxxxxxx xxx xxxx, xxxxxxxxxx xxx xxxxxx xx protection xxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxx asset xx xxx xxxxxxxx xxxxxxxx xxxxxxxxx and shall xxxx xxxx xxxx xxxxxxxxxxxxx xxx xxxxxxxxxx XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx classification xxxxxx approved xx xxx management xxxxx xx xxxx xx xxxxxx xx xxxxxxxxxxx xxx of protection xxxxxxxx xxxxxxxxxx the xxxxxxxxxxx xxxxx lifecycle (xxxxxxxxx xxxxxxx xxx xxxxxxxxxxx of xxxxxxxxxxx xxxxxx) xxx to xxxxxxxxxxx xxx need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Human xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx xx addressed xxxxx xx xxxxxxxxxx xx adequate xxx xxxxxxxxxxxx and xx xxxxx and xxxxxxxxxx xx employment. All xxxxxxxxxx xxx xxxxxxxxxx, xxxxxxxxxxx xxx third xxxxx users shall xx xxxxxxxxxx xxxxxxxx, xxxxxxxxxx for sensitive xxxx. Xxxxxxxxx, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxxx facilities xxxxx xxxx xx xxxxxxxxx xx xxxxx xxxxxxxx xxxxx and responsibilities. Xx xxxxxxxx xxxxx xx awareness xxxxx xx xxxxxxx among xxx xxxxxxxxx, xxxxxxxxxxx xxx third xxxxx xxxxx, xxx education xxx training in xxxxxxxx procedures xxx xxx xxxxxxx use xx information processing xxxxxxxxxx xxxxx be xxxxxxxx to them xx minimise possible xxxxxxxx risks. X&xxxx;xxxxxx xxxxxxxxxxxx xxxxxxx xxx xxxxxxxx security xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx xx xxxxxx xxxx xx xxxxxxxx’x, xxxxxxxxxx’x or xxxxx xxxxx xxxx’x xxxx xxxx xx xxxxxxxx xxxxxx xxx organisation xx xxxxxxx, xxx xxxx the return xx xxx equipment xxx xxx removal xx all access xxxxxx are xxxxxxxxx.

Xxxxxxxxxxx 1.7: Physical xxx xxxxxxxxxxxxx xxxxxxxx

Xxxxxxxx xx xxxxxxxxx information processing xxxxxxxxxx xxxxx be xxxxxx in xxxxxx xxxxx, xxxxxxxxx xx xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxx xxx entry xxxxxxxx. Xxxx shall xx xxxxxxxxxx xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx and xxxxxxxxxxxx. Xxxxxx xxxxx be xxxxxxx xxxx to xxxxxxxxxxx who fall xxxxxx xxx xxxxx xx Requirement 1.6. Xxxxxxxxxx and xxxxxxxxx xxxxx xx established xx xxxxxxx xxxxxxxx xxxxx containing information xxxxxx when in xxxxxxx.

Xxxxxxxxx xxxxx xx xxxxxxxxx xxxx xxxxxxxx xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx xxxxxxxxx (xxxxxxxxx xxxxxxxxx xxxx xxx-xxxx) and xxxxxxx xxx xxxxxxx xx xxxxxxxx is xxxxxxxxx xx reduce xxx xxxx xx xxxxxxxxxxxx xxxxxx to information xxx xx xxxxx xxxxxxx xxxx xx xxxxxx xx equipment xx xxxxxxxxxxx. Special xxxxxxxx xxx be xxxxxxxx xx xxxxxxx xxxxxxx physical threats xxx xx xxxxxxxxx xxxxxxxxxx facilities xxxx xx xxx xxxxxxxxxx xxxxxx and xxxxxxx xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Operations xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx be established xxx xxx xxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx all the xxxxxxxxxx systems in xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, including xxxxxxxxx xxxxxxxxxxxxxx xx XX systems, xxxxxxxxxxx xx duties xxxxx xx implemented, where xxxxxxxxxxx, xx xxxxxx xxx xxxx xx xxxxxxxxx or deliberate xxxxxx xxxxxx. Where xxxxxxxxxxx xx duties xxxxxx be xxxxxxxxxxx xxx to documented xxxxxxxxx xxxxxxx, xxxxxxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxxxxxxxx x&xxxx;xxxxxx xxxx xxxxxxxx. Xxxxxxxx xxxxx xx established xx prevent xxx xxxxxx xxx introduction xx xxxxxxxxx xxxx xxx systems xx xxx Payment Xxxxxxxxxxx Xxxxx. Xxxxxxxx shall xx xxxx established (xxxxxxxxx xxxx xxxxxxxxx) xx prevent, detect xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx xxxx xxxxx xx xxxx xxxx from xxxxxxx xxxxxxx (x.x. xxxxxx Xxxxxxxxx XXX components xxx Xxxx Applets). Xxx xxxxxxxxxxxxx xx xxx browser (x.x. xxx xxx xx xxxxxxxxxx and plugins) xxxxx be xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx xxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx xxxxx xxxxxxx x&xxxx;xxxx xx xxx xxxxxxxxxxx xxxxxxx xxxxx is tested xx xxxxxxx xxxxxxxxx xx xxxxx xxxxxxxx.

Xxxxxxx xxxx are xxxxxxxx xxx xxx xxxxxxxx xx xxxxxxxx xxxxx xx xxxxxxxxx xxx xxxxxx xxxxxxxx xx xxxxxxxxxxx security xxxxx xx xxxxxxxx. Xxxxxxxx xxxx shall xx xxxx xx xxxxxx xxxx xxxxxxxxxxx xxxxxx xxxxxxxx xxx xxxxxxxxxx. Xxxxxxxx logs xxxxx xx xxxxxxxxx xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx monitoring xxxxx be used xx xxxxx xxx xxxxxxxxxxxxx of xxxxxxxx xxxxx are identified xx xxxxxxxx for xxx security xx xxxxxxxx xxx xx xxxxxx xxxxxxxxxx xx xx access xxxxxx xxxxx.

Xxxxxxxxx of information xxxxxxx organisations shall xx based on x&xxxx;xxxxxx xxxxxxxx policy, xxxxxxx out in xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx xxxxxxx xxx xxxxx be xxxxxxxxx xxxx xxx xxxxxxxx xxxxxxxxxxx. Xxxxx party xxxxxxxx components xxxxxxxx xx xxx xxxxxxxx xx information with XXXXXX2 (xxxx xxxxxxxx xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx xx scenario 2 of the xxxxx xxxxxxx of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx document) xxxx xx xxxx xxxxx x&xxxx;xxxxxx xxxxxxxxx xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Xxxxxx xxxxxxx

Xxxxxx xx xxxxxxxxxxx xxxxxx xxxxx xx justified xx xxx basis xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx according xx the xxxxxxxxxxx xxxxxxxxx xx xxxxxxxxx xxxxxxxx (xxxxxxxxx the xxxxxxxxxxx xxxxxxxx xxxxxx). Xxxxx access xxxxxxx xxxxx xxxxx xx xxxxxxx xxxxx on xxx xxxxxxxxx xx xxxxx privilege (2) xx xxxxxxx closely the xxxxx xx the xxxxxxxxxxxxx business xxx XX xxxxxxxxx. Xxxxx xxxxxxxx (e.g. for xxxxxx xxxxxxxxxx) xxxxxxx xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, xxxxxxxx xxxx xxxxxxxxxxxxx).

Xxxxxx xxx xxxxxxxxxx xxxxxxxxxx xxxxx xx xx xxxxx xx xxxxxxx xxx allocation xx xxxxxx xxxxxx xx information xxxxxxx xxx services xxxx xxxx xxxxxx the xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx procedures xxxxx xxxxx xxx stages xx xxx lifecycle xx user xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx of xxx xxxxx to xxx xxxxx xxxxxxxxxxxxxx xx xxxxx xxxx no xxxxxx xxxxxxx xxxxxx.

Xxxxxxx xxxxxxxxx shall xx xxxxx, where appropriate, xx xxx xxxxxxxxxx xx access xxxxxx xx xxxx xxxxxxxxxxx xxxx xxx abuse xx xxxxx access xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx xxxxxxx xxxxxx xx xxx xxxxxxxxxx xx xxx xxxxxxxxxxx (x.x. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, xxxxxxxx xx xxxxxx controls, direct xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx in xxxxx xx xxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xxxxx xx specific xxxxxx xx the xxxxxxxxxxxx’x xxxxxxx, x.x. xxx xxxxx and xxxxxx xxxxxx to xxxxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain. Xxxxxxxx accounts xxxxx xxx xx xxxxxx xx xxxxx xx xxxxxx xxxxxxxxxxxxxx.

Xxx xxxxxxxxx, xxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxx xx specific controls xx ensure xxxx xxxxxxxxx xxxxxx be xxxxxx xxxxxxx, x.x. xxxxxxxxxx rules xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx xxxxxxxx xxx/xx xxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx.

X&xxxx;xxxxxx shall xx xxxxxxxxx xxx xxxxxxxxxxx on the xxx xx cryptographic xxxxxxxx xx xxxxxxx xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx xx xxxxxxxxxxx. X&xxxx;xxx xxxxxxxxxx xxxxxx xxxxx xx xxxxxxxxxxx to xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx policy for xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx xx xx print (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) to xxxxxx xxx risk xx unauthorised access.

When xxxxxxx xxxxxxxx, the xxxxx xx xxxxxxx xx an xxxxxxxxxxx xxxxxxxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxx and xxxxxxxxxxxxxx xxxxxxxx shall xx xxxxxxx.

Xxxxxxxxxxx 1.10: Information xxxxxxx acquisition, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx xxxxxxxxxxxx xxxxx be identified xxx xxxxxx prior xx xxx xxxxxxxxxxx xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx be xxxxx xxxx applications, including xxxx-xxxxxxxxx xxxxxxxxxxxx, to xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx xxxxxxxx shall xxxxxxx xxx xxxxxxxxxx xx xxxxx xxxx, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx xxx xx xxxxxxxx xxx xxxxxxx xxxx process, xx xxxx xx xxxxxx xx, xxxxxxxxx, valuable xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx xxxxx xx determined on xxx xxxxx of xxxxxxxx xxxxxxxxxxxx xxx xxxx xxxxxxxxxx according xx the xxxxxxxxxxx xxxxxxxx (x.x. information xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxx xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx shall xx xxxxxxxxxxx, documented xxx xxxxxx xxxxx to xxxxx acceptance xxx xxx. Xx xxxxxxx xxxxxxx security, xxxxxxxxxxx xxxxxxxx, xxxxxxxxx xxxxxxxxxxxx xxx secure xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx of data xxxxx xxx the xxxxx xx xxxx xx xxx network xxxxx xx xxx xxxxxxxxxxxx. Xxxxx xxxxx xx xxxxxxxx xxxxxxxx xx protect xxxxxxxxx xxxxxxxxxxx xxxxxxx over xxxxxx xxxxxxxx.

Xxxxxx xx xxxxxx xxxxx xxx xxxxxxx xxxxxx code xxxxx xx xxxxxxxxxx xxx IT xxxxxxxx xxx support xxxxxxxxxx xxxxxxxxx xx a secure xxxxxx. Care xxxxx xx taken xx xxxxx xxxxxxxx of xxxxxxxxx xxxx xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx xx strictly xxxxxxxxxx. Xxxxxxxxxx of xxxxxxx xx xxxxxxxxxx xxxxx xx strictly xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx major xxxxxxx xx xx xxxxxxxx in production xxxxx be xxxxxxxxx.

Xxxxxxx xxxxxxxx testing xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx also xx xxxxxxxxx according xx x&xxxx;xxxxxxxxxx xxxx xxxxx xx xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, xxx xxxxxxxx xxxxxxx xxxxx xxxxxxx, xx xxxxx, xxxxxxxxxxxxx xxxxxxxxxxx. Xxx xx xxx xxxxxxxxxxxx xxxxxxxxxxx xxxxxx the xxxxxxxx xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx and xxxxxx xxxxx xx xxxxx xxx xxxxxxxxxx xxx xxxxx be xxxxxxxx xxx followed xx in x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Information xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems xxxx are xxxxxxxxxx xx suppliers, xxxxxxxxxxx xxxxxxxx xxxxxxxxxxxx xxx xxxxxxxxxx the xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx xxxxx xx xxxxxxxxxx xxx xxxxxxxx xxxxxx xxxx with xxx supplier.

Requirement 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx xxxxxx a consistent xxx effective xxxxxxxx xx xxx xxxxxxxxxx xx information xxxxxxxx xxxxxxxxx, xxxxxxxxx communication xx xxxxxxxx events xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx xxx procedures, xx xxxxxxxx and xxxxxxxxx xxxxx, shall xx xxxxxxxxxxx xxx xxxxxx xx xxxxxx x&xxxx;xxxxx, effective xxx xxxxxxx xxx xxxxxx xxxxxxx xxxx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx related xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx xxxxxxx xx xx xxxxxxxx xxxxxxxx xx by an xxxxxxx). Personnel xxxxxxxx xx xxxxx xxxxxxxxxx xxxxx xx xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Xxxxxxxxx xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x internal xxxxxxxxxxx systems (x.x. xxxx office xxxxxxx, xxxxxxxx networks xxx xxxxxxxx xxxxxxx connectivity) xxxxx xx xxxxxxxxx xxxxxxxx xxx xxxxxxxxxx xxxx xxx organisation’s xxxxxxxxxxx xxxxxxxxx of xxxxxxxx (x.x. xxxxxxxxxxx xxxxxxxx xxxxxx, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx virtual machines xxxxx xxxxxx with xxx xxx xxxxxxxx xxxxxxxx xxxx xxx xxx xxx physical xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, logging). Xxxxxxxx xxxxxxxx to xxxxxxxxxxx must include: xxxxxxxxx of xxx xxxxxxxxxx and xxx xxxxxxx operating xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx of xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx development). Centralised xxxxxxxxxx, logging and xxxxxxxxxx xx well xx xxxxxxxx xx xxxxxx xxxxxx, xx xxxxxxxxxx xxx xxxx xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx based xx x&xxxx;xxxx xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx by the xxxx xxxxxxxxxx shall xxxx x&xxxx;xxxxxxx xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx usage xx xxxxxx xxx/xx xxxxxx xxxxx xxxxxxxxx in xxx Payment Transaction Xxxxx must xx xxxxx xx x&xxxx;xxxxxx xxxx assessment, xxxxxx xxxx xxxxxxx xxx xxxxxxxxx controls xxx xxx xxxxxxxxxxx xxxxxxx xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx xxx xxxx, xx is xxxxxxxxxx that xxx xxxxxxxxxxx xxxxx xx xxx overall xxxxxx xx xxx xxxxxxx xxx xx xxx xxxxxxxxx systems. All xx-xxxxxxxx xxxxxxxxxx xx xxx xxxxxx xxxxxxxxx xxxx be xxxxxxxxxx xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx only xx xxxxxxxx participants)

The xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Each XXXXXX2 xxxxxxxxxxx classified xx xxx Xxxxxxxxxx xx xxxxx xxxxxxxx for xxx xxxxxx xxxxxxxxxxx xx xxx TARGET2 xxxxxx shall xxxx x&xxxx;xxxxxxxx continuity xxxxxxxx xx xxxxx xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx plans xxxxx xx xxxxxxxxx xxx procedures xxx xxxxxxxxxxx xxxx xxx xx place.
Requirement 2.2	:	Xx xxxxxxxxx operational xxxx xxxxx xx available.
Requirement 2.3	:	Xxx xxxx profile xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxx that xx xxx xxxxxxx xxxx, in order xx avoid xxxx xxxx xxxxx xxx xxxxxxxx xx the xxxx xxxxx xx xxx xxxx time. Xxx xxxxxxx, xxx xxxxxxxxx site xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx xxxx and xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx those xx xxx primary business xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx of a major xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary xxxx xxxxxxxxxxxx xxx/xx xxxxxxxx xxxxx xxxxxxxxxxx, the xxxxxxxx xxxxxxxxxxx xxxxx xx xxxx xx xxxxxx xxxxxx xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, where xx xxxxx xx xxxxxxxx xx xxxxxxxx xxxxx xxx business xxx xxx open xxx xxxxxxxxx xxxxxxxx xxx(x).
Xxxxxxxxxxx 2.5	:	Xxxxxxxxxx xxxxx xx xx xxxxx to xxxxxx that the xxxxxxxxxx of xxxxxxxxxxxx xx xxxxxxx xxxx xxx xxxxxxxxx site xxxxxx x&xxxx;xxxxxxxxxx xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx xx service xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx of xxx xxxxxxxx xxxx xxx disrupted.
Requirement 2.6	:	Xxx xxxxxxx xx cope xxxx xxxxxxxxxxx xxxxxxxxxxx xxxxx be xxxxxx xx least xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx xx xxxxxxxxxxxxx xxxxxxx. The xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx xxx xxxxxx one xxxx.