Plné znění - 32021D1758

„Xxxxxxxx VII

Requirements regarding xxxxxxxxxxx security xxxxxxxxxx xxx xxxxxxxx continuity xxxxxxxxxx

Xxxxxxxxxxx xxxxxxxx xxxxxxxxxx

Xxxxx xxxxxxxxxxxx xxx xxxxxxxxxx xx xxxx xxxxxxxxxxx, xxxxxx xxx xxxxxxxxxxx xxxxxxxxxxxx xxxx x&xxxx;xxxxxxxx xxxxxxxxxxx is xxx xxxxxxxxxx to it. Xx xxxxxxxxxxxx xxx xxxxx of xxxxxxxxxxx xx the xxxxxxxxxxxx xxxxxx xxx xxxxxxxxxxxxxx, xxx xxxxxxxxxxx should xxxxxxxx xxx xxxxxxxx xxxx xxx xxxx xx xxx Xxxxxxx Xxxxxxxxxxx Chain (PTC). Xxxxxxxxxxxx, xxx XXX xxxxxx at a Point xx Xxxxx (PoE), x.x. x&xxxx;xxxxxx xxxxxxxx xx xxx xxxxxxxx xx xxxxxxxxxxxx (x.x. xxxxxxxxxxxx, front-office xxx xxxx-xxxxxx xxxxxxxxxxxx, xxxxxxxxxx), xxx xxxx at xxx xxxxxx responsible xx send the xxxxxxx to SWIFT (x.x. SWIFT VPN Xxx) or Xxxxxxxx (xxxx xxx xxxxxx xxxxxxxxxx xx Internet-based Xxxxxx).

Xxxxxxxxxxx 1.1: Xxxxxxxxxxx xxxxxxxx policy

The xxxxxxxxxx xxxxx xxx x&xxxx;xxxxx xxxxxx direction xx xxxx xxxx business xxxxxxxxxx xxx demonstrate xxxxxxx xxx and xxxxxxxxxx to xxxxxxxxxxx xxxxxxxx through xxx xxxxxxxx, xxxxxxxx and xxxxxxxxxxx of xx xxxxxxxxxxx xxxxxxxx policy xxxxxx at xxxxxxxx xxxxxxxxxxx security xxx xxxxx xxxxxxxxxx xxxxxx xxx organisation in xxxxx of xxxxxxxxxxxxxx, xxxxxxxxxx and xxxxxxxxx xx xxxxxxxxxxx security xxx cyber xxxxxxxxxx xxxxx. Xxx policy xxxxxx xxxxxxx xx xxxxx xxx xxxxxxxxx xxxxxxxx: objectives, scope (xxxxxxxxx domains xxxx xx xxxxxxxxxxxx, human xxxxxxxxx, xxxxx management xxx.), principles xxx xxxxxxxxxx xx responsibilities.

Requirement 1.2: Xxxxxxxx xxxxxxxxxxxx

Xx xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx implement the xxxxxxxxxxx security xxxxxx xxxxxx xxx xxxxxxxxxxxx. Xxx xxxxxxxxxx shall xxxxxxxxxx and review xxx establishment of xxx information security xxxxxxxxx to xxxxxx xxx xxxxxxxxxxxxxx xx xxx xxxxxxxxxxx xxxxxxxx xxxxxx (as per Xxxxxxxxxxx 1.1) across xxx xxxxxxxxxxxx, xxxxxxxxx xxx allocation xx xxxxxxxxxx resources xxx xxxxxxxxxx xx security xxxxxxxxxxxxxxxx for this xxxxxxx.

Xxxxxxxxxxx 1.3: External xxxxxxx

Xxx xxxxxxxx xx xxx organisation’s xxxxxxxxxxx xxx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxx not xx xxxxxxx xx xxx introduction xx, xxx/xx the dependence xx, xx xxxxxxxx xxxxx/xxxxxxx xx xxxxxxxx/xxxxxxxx xxxxxxxx xx them. Xxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xx xxxxxxxx parties xxxxx xx xxxxxxxxxx. When xxxxxxxx xxxxxxx or xxxxxxxx/xxxxxxxx of external xxxxxxx xxx xxxxxxxx xx xxxxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx, x&xxxx;xxxx xxxxxxxxxx xxxxx be carried xxx to determine xxx security implications xxx control xxxxxxxxxxxx. Xxxxxxxx shall xx xxxxxx xxx xxxxxxx xx xx agreement xxxx xxxx xxxxxxxx xxxxxxxx xxxxx.

Xxxxxxxxxxx 1.4: Xxxxx management

All xxxxxxxxxxx xxxxxx, xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxxxxx xxxxxxxxxxx xxxxxxx, xxxx xx operating xxxxxxx, xxxxxxxxxxxxxxx, business xxxxxxxxxxxx, xxx-xxx-xxxxx xxxxxxxx, xxxxxxxx xxx user-developed xxxxxxxxxxxx, xx xxx xxxxx of the Xxxxxxx Xxxxxxxxxxx Xxxxx xxxxx be accounted xxx and xxxx x&xxxx;xxxxxxxxx xxxxx. The xxxxxxxxxxxxxx xxx xxx xxxxxxxxxxx and xxx xxxxxxxxx xx appropriate xxxxxxxx xx xxx xxxxxxxx xxxxxxxxx xxx xxx xxxxxxx XX xxxxxxxxxx xx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxxxx xx xxxxxxxx. Xxxx: the xxxxx xxx delegate the xxxxxxxxxxxxxx xx xxxxxxxx xxxxxxxx xx appropriate, xxx remains accountable xxx xxx xxxxxx xxxxxxxxxx xx the xxxxxx.

Xxxxxxxxxxx 1.5: Xxxxxxxxxxx xxxxxx xxxxxxxxxxxxxx

Xxxxxxxxxxx xxxxxx xxxxx be classified xx xxxxx of xxxxx xxxxxxxxxxx xx xxx smooth delivery xx the xxxxxxx xx xxx participant. Xxx xxxxxxxxxxxxxx xxxxx xxxxxxxx xxx need, xxxxxxxxxx xxx xxxxxx xx xxxxxxxxxx required xxxx xxxxxxxx xxx xxxxxxxxxxx xxxxx in xxx xxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxx xxxx xxxx xxxx xxxxxxxxxxxxx xxx underlying XX xxxxxxxxxx. Xx xxxxxxxxxxx xxxxx xxxxxxxxxxxxxx xxxxxx xxxxxxxx xx xxx xxxxxxxxxx xxxxx xx xxxx xx xxxxxx xx appropriate xxx xx xxxxxxxxxx xxxxxxxx throughout the xxxxxxxxxxx xxxxx xxxxxxxxx (xxxxxxxxx removal xxx xxxxxxxxxxx xx xxxxxxxxxxx xxxxxx) xxx xx xxxxxxxxxxx xxx need xxx xxxxxxxx xxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 1.6: Xxxxx xxxxxxxxx xxxxxxxx

Xxxxxxxx xxxxxxxxxxxxxxxx xxxxx be xxxxxxxxx xxxxx xx xxxxxxxxxx xx xxxxxxxx job xxxxxxxxxxxx xxx in xxxxx xxx xxxxxxxxxx xx employment. Xxx xxxxxxxxxx xxx employment, xxxxxxxxxxx and third xxxxx xxxxx xxxxx xx adequately xxxxxxxx, xxxxxxxxxx for xxxxxxxxx xxxx. Xxxxxxxxx, contractors xxx xxxxx xxxxx xxxxx of xxxxxxxxxxx xxxxxxxxxx facilities shall xxxx xx agreement xx their security xxxxx xxx responsibilities. Xx xxxxxxxx xxxxx xx xxxxxxxxx xxxxx xx ensured xxxxx xxx employees, xxxxxxxxxxx xxx xxxxx xxxxx xxxxx, and education xxx xxxxxxxx in xxxxxxxx xxxxxxxxxx xxx xxx xxxxxxx xxx xx xxxxxxxxxxx processing xxxxxxxxxx shall xx xxxxxxxx xx them xx minimise xxxxxxxx xxxxxxxx xxxxx. X&xxxx;xxxxxx xxxxxxxxxxxx process for xxxxxxxx xxxxxxxx xxxxxxxx xxxxx xx xxxxxxxxxxx xxx xxxxxxxxx. Xxxxxxxxxxxxxxxx xxxxx be xx xxxxx to ensure xxxx xx employee’s, xxxxxxxxxx’x or xxxxx xxxxx xxxx’x xxxx xxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxxxx xx xxxxxxx, xxx xxxx the xxxxxx xx all equipment xxx xxx removal xx all xxxxxx xxxxxx xxx xxxxxxxxx.

Xxxxxxxxxxx 1.7: Xxxxxxxx xxx xxxxxxxxxxxxx security

Critical xx xxxxxxxxx information xxxxxxxxxx xxxxxxxxxx xxxxx xx xxxxxx xx xxxxxx xxxxx, protected by xxxxxxx security xxxxxxxxxx, xxxx xxxxxxxxxxx security xxxxxxxx xxx xxxxx xxxxxxxx. They shall xx physically xxxxxxxxx xxxx xxxxxxxxxxxx access, xxxxxx xxx interference. Xxxxxx xxxxx be xxxxxxx only xx xxxxxxxxxxx xxx xxxx xxxxxx xxx scope xx Xxxxxxxxxxx 1.6. Xxxxxxxxxx xxx xxxxxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxxxxxxx xxxxx xxxxxxxxxx xxxxxxxxxxx xxxxxx xxxx xx xxxxxxx.

Xxxxxxxxx xxxxx be xxxxxxxxx xxxx physical xxx xxxxxxxxxxxxx xxxxxxx. Xxxxxxxxxx xx equipment (xxxxxxxxx equipment xxxx xxx-xxxx) and xxxxxxx xxx xxxxxxx of xxxxxxxx is xxxxxxxxx xx xxxxxx xxx xxxx xx xxxxxxxxxxxx xxxxxx xx information xxx xx guard xxxxxxx loss or xxxxxx xx xxxxxxxxx xx xxxxxxxxxxx. Xxxxxxx xxxxxxxx may xx xxxxxxxx to xxxxxxx xxxxxxx physical xxxxxxx xxx xx safeguard xxxxxxxxxx xxxxxxxxxx such xx xxx xxxxxxxxxx xxxxxx and cabling xxxxxxxxxxxxxx.

Xxxxxxxxxxx 1.8: Xxxxxxxxxx xxxxxxxxxx

Xxxxxxxxxxxxxxxx xxx xxxxxxxxxx xxxxx xx xxxxxxxxxxx xxx the management xxx xxxxxxxxx xx xxxxxxxxxxx xxxxxxxxxx xxxxxxxxxx xxxxxxxx xxx xxx xxxxxxxxxx xxxxxxx xx xxx Payment Xxxxxxxxxxx Xxxxx xxx-xx-xxx.

Xx xxxxxxx xxxxxxxxx xxxxxxxxxx, including xxxxxxxxx xxxxxxxxxxxxxx xx XX systems, xxxxxxxxxxx xx xxxxxx xxxxx xx xxxxxxxxxxx, xxxxx xxxxxxxxxxx, xx reduce xxx xxxx xx xxxxxxxxx or deliberate xxxxxx misuse. Where xxxxxxxxxxx of xxxxxx xxxxxx be xxxxxxxxxxx xxx xx xxxxxxxxxx xxxxxxxxx reasons, xxxxxxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx following a formal xxxx xxxxxxxx. Controls xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxxxxx xxx introduction xx xxxxxxxxx code xxx systems xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxxxxxxx xxxxx xx xxxx xxxxxxxxxxx (xxxxxxxxx xxxx xxxxxxxxx) xx prevent, xxxxxx xxx xxxxxx xxxxxxxxx xxxx. Xxxxxx code xxxxx xx used xxxx xxxx xxxxxxx xxxxxxx (e.g. signed Xxxxxxxxx COM xxxxxxxxxx xxx Xxxx Applets). Xxx xxxxxxxxxxxxx xx xxx browser (x.x. xxx use xx xxxxxxxxxx and xxxxxxx) xxxxx xx xxxxxxxx xxxxxxxxxx.

Xxxx xxxxxx and xxxxxxxx xxxxxxxx shall xx xxxxxxxxxxx xx xxx xxxxxxxxxx; xxxxx xxxxxxxx xxxxxxxx shall xxxxxxx a plan xx xxx xxxxxxxxxxx xxxxxxx xxxxx is xxxxxx xx regular xxxxxxxxx xx xxxxx annually.

Systems xxxx are xxxxxxxx xxx xxx security xx payments shall xx monitored xxx xxxxxx xxxxxxxx to xxxxxxxxxxx security shall xx xxxxxxxx. Operator xxxx shall xx xxxx to xxxxxx xxxx information xxxxxx xxxxxxxx are xxxxxxxxxx. Xxxxxxxx xxxx xxxxx xx xxxxxxxxx xxxxxxxx xx x&xxxx;xxxxxx xxxxx, xxxxx on xxx xxxxxxxxxxx xx xxx xxxxxxxxxx. Xxxxxx xxxxxxxxxx xxxxx xx used xx check the xxxxxxxxxxxxx xx xxxxxxxx xxxxx are xxxxxxxxxx xx xxxxxxxx for xxx security of xxxxxxxx and to xxxxxx conformity to xx access policy xxxxx.

Xxxxxxxxx xx xxxxxxxxxxx xxxxxxx organisations xxxxx xx based xx x&xxxx;xxxxxx xxxxxxxx xxxxxx, xxxxxxx out xx xxxx xxxx xxxxxxxx xxxxxxxxxx among xxx xxxxxxxx parties xxx xxxxx be xxxxxxxxx xxxx any relevant xxxxxxxxxxx. Xxxxx xxxxx xxxxxxxx components employed xx xxx xxxxxxxx xx xxxxxxxxxxx with XXXXXX2 (xxxx software xxxxxxxx xxxx x&xxxx;Xxxxxxx Xxxxxx xx xxxxxxxx 2 of the xxxxx xxxxxxx of xxx XXXXXX2 xxxx-xxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxx) xxxx xx xxxx xxxxx x&xxxx;xxxxxx agreement xxxx xxx xxxxx xxxxx.

Xxxxxxxxxxx 1.9: Access control

Access xx information xxxxxx xxxxx xx xxxxxxxxx xx xxx xxxxx xx xxxxxxxx xxxxxxxxxxxx (xxxx-xx-xxxx&xxxx;(1)) xxx according xx the xxxxxxxxxxx xxxxxxxxx of xxxxxxxxx xxxxxxxx (xxxxxxxxx xxx xxxxxxxxxxx security xxxxxx). Xxxxx access xxxxxxx xxxxx shall be xxxxxxx based on xxx xxxxxxxxx xx xxxxx xxxxxxxxx&xxxx;(2) to xxxxxxx xxxxxxx the xxxxx xx the xxxxxxxxxxxxx xxxxxxxx xxx XX xxxxxxxxx. Xxxxx xxxxxxxx (x.x. for xxxxxx xxxxxxxxxx) logical xxxxxx xxxxxxx xxxxxx xx xxxxxxxxxx xxxx xxxxxxxx xxxxxx xxxxxxx xxxxxx there xxx xxxxxxxx xxxxxxxxxxxx xxxxxxxx xx xxxxx (x.x. xxxxxxxxxx, xxxxxxxx data xxxxxxxxxxxxx).

Xxxxxx xxx documented xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxxx the allocation xx xxxxxx xxxxxx xx xxxxxxxxxxx systems xxx xxxxxxxx xxxx xxxx within xxx xxxxx xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx. Xxx xxxxxxxxxx xxxxx xxxxx xxx xxxxxx xx xxx xxxxxxxxx xx xxxx xxxxxx, xxxx xxx xxxxxxx xxxxxxxxxxxx xx xxx xxxxx xx xxx xxxxx xxxxxxxxxxxxxx xx xxxxx that xx xxxxxx xxxxxxx xxxxxx.

Xxxxxxx xxxxxxxxx xxxxx be xxxxx, xxxxx xxxxxxxxxxx, xx the allocation xx xxxxxx rights xx xxxx criticality xxxx xxx xxxxx xx xxxxx xxxxxx xxxxxx xxxxx xxxx xx x&xxxx;xxxxxx adverse xxxxxx on the xxxxxxxxxx xx xxx xxxxxxxxxxx (e.g. xxxxxx xxxxxx xxxxxxxx xxxxxx xxxxxxxxxxxxxx, override xx xxxxxx xxxxxxxx, xxxxxx xxxxxx xx xxxxxxxx xxxx).

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxx xx xxxxx xx identify, xxxxxxxxxxxx xxx authorise xxxxx at xxxxxxxx xxxxxx xx xxx xxxxxxxxxxxx’x xxxxxxx, x.x. xxx local xxx xxxxxx access xx xxxxxxx in the Xxxxxxx Transaction Xxxxx. Xxxxxxxx xxxxxxxx xxxxx xxx xx xxxxxx xx order xx xxxxxx xxxxxxxxxxxxxx.

Xxx passwords, xxxxx shall be xxxxxxxxxxx xxx xxxxxxxx xx xxxxxxxx xxxxxxxx xx ensure xxxx xxxxxxxxx cannot xx xxxxxx xxxxxxx, e.g. xxxxxxxxxx rules xxx xxxxxxx-xxxx validity. X&xxxx;xxxx xxxxxxxx recovery xxx/xx xxxxx protocol xxxxx xx established.

A policy xxxxx xx xxxxxxxxx and xxxxxxxxxxx on xxx xxx of xxxxxxxxxxxxx xxxxxxxx xx protect xxx xxxxxxxxxxxxxxx, xxxxxxxxxxxx xxx xxxxxxxxx of xxxxxxxxxxx. X&xxxx;xxx management xxxxxx xxxxx be xxxxxxxxxxx xx xxxxxxx xxx xxx xx xxxxxxxxxxxxx xxxxxxxx.

Xxxxx xxxxx xx xxxxxx xxx xxxxxxx xxxxxxxxxxxx xxxxxxxxxxx xx xxxxxx or xx print (x.x. x&xxxx;xxxxx xxxxxx, x&xxxx;xxxxx xxxx xxxxxx) xx xxxxxx xxx risk xx xxxxxxxxxxxx xxxxxx.

Xxxx xxxxxxx xxxxxxxx, the xxxxx xx working xx an xxxxxxxxxxx xxxxxxxxxxx shall be xxxxxxxxxx and appropriate xxxxxxxxx xxx organisational xxxxxxxx xxxxx xx xxxxxxx.

Xxxxxxxxxxx 1.10: Xxxxxxxxxxx xxxxxxx xxxxxxxxxxx, xxxxxxxxxxx xxx xxxxxxxxxxx

Xxxxxxxx requirements xxxxx xx xxxxxxxxxx xxx agreed xxxxx xx xxx development xxx/xx xxxxxxxxxxxxxx xx xxxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx xxxxxxxx xxxxx xx xxxxx xxxx xxxxxxxxxxxx, including xxxx-xxxxxxxxx applications, xx xxxxxx xxxxxxx xxxxxxxxxx. Xxxxx controls xxxxx xxxxxxx xxx validation xx input data, xxxxxxxx xxxxxxxxxx xxx xxxxxx xxxx. Xxxxxxxxxx xxxxxxxx may be xxxxxxxx xxx systems xxxx xxxxxxx, xx xxxx xx impact xx, sensitive, xxxxxxxx xx xxxxxxxx xxxxxxxxxxx. Xxxx xxxxxxxx shall xx determined on xxx xxxxx xx xxxxxxxx requirements xxx xxxx assessment xxxxxxxxx xx xxx established xxxxxxxx (x.x. information xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx policy).

The xxxxxxxxxxx xxxxxxxxxxxx xx xxx xxxxxxx shall be xxxxxxxxxxx, documented and xxxxxx xxxxx xx xxxxx xxxxxxxxxx and xxx. Xx xxxxxxx xxxxxxx security, xxxxxxxxxxx xxxxxxxx, including segmentation xxx xxxxxx xxxxxxxxxx, xxxxxx xx xxxxxxxxxxx xxxxx xx xxx xxxxxxxxxxx of xxxx xxxxx xxx the xxxxx xx xxxx xx xxx xxxxxxx xxxxx in the xxxxxxxxxxxx. There xxxxx xx xxxxxxxx xxxxxxxx xx xxxxxxx xxxxxxxxx xxxxxxxxxxx xxxxxxx xxxx xxxxxx xxxxxxxx.

Xxxxxx to xxxxxx files xxx xxxxxxx xxxxxx code xxxxx xx xxxxxxxxxx xxx IT xxxxxxxx xxx xxxxxxx xxxxxxxxxx xxxxxxxxx in x&xxxx;xxxxxx xxxxxx. Care xxxxx xx xxxxx to xxxxx xxxxxxxx xx xxxxxxxxx data xx xxxx xxxxxxxxxxxx. Xxxxxxx xxx xxxxxxx environments xxxxx xx xxxxxxxx xxxxxxxxxx. Xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx xx xxxxxxxx xxxxxxxxxx. X&xxxx;xxxx assessment xx xxx xxxxx xxxxxxx xx xx xxxxxxxx in xxxxxxxxxx xxxxx xx xxxxxxxxx.

Xxxxxxx xxxxxxxx xxxxxxx xxxxxxxxxx xx xxxxxxx xx xxxxxxxxxx xxxxx also xx xxxxxxxxx xxxxxxxxx xx x&xxxx;xxxxxxxxxx xxxx xxxxx on xxx xxxxxxx of x&xxxx;xxxx xxxxxxxxxx, and security xxxxxxx shall include, xx least, xxxxxxxxxxxxx xxxxxxxxxxx. All xx xxx shortcomings xxxxxxxxxxx xxxxxx xxx security xxxxxxx xxxxxxxxxx xxxxx xx xxxxxxxx and xxxxxx plans to xxxxx xxx identified xxx xxxxx be xxxxxxxx and followed xx in x&xxxx;xxxxxx xxxxxxx.

Xxxxxxxxxxx 1.11: Xxxxxxxxxxx xxxxxxxx xx xxxxxxxx&xxxx;(3) xxxxxxxxxxxxx

Xx xxxxxx xxxxxxxxxx xx xxx xxxxxxxxxxx’x xxxxxxxx information xxxxxxx xxxx are xxxxxxxxxx xx xxxxxxxxx, xxxxxxxxxxx xxxxxxxx requirements xxx xxxxxxxxxx xxx xxxxx xxxxxxxxxx xxxx xxxxxxxx’x xxxxxx shall xx xxxxxxxxxx xxx xxxxxxxx xxxxxx upon with xxx xxxxxxxx.

Xxxxxxxxxxx 1.12: Xxxxxxxxxx of xxxxxxxxxxx xxxxxxxx xxxxxxxxx xxx xxxxxxxxxxxx

Xx ensure x&xxxx;xxxxxxxxxx xxx xxxxxxxxx xxxxxxxx xx xxx xxxxxxxxxx xx information security xxxxxxxxx, xxxxxxxxx xxxxxxxxxxxxx xx xxxxxxxx xxxxxx xxx xxxxxxxxxx, xxxxx, xxxxxxxxxxxxxxxx and xxxxxxxxxx, xx xxxxxxxx and xxxxxxxxx xxxxx, xxxxx xx established and xxxxxx xx ensure x&xxxx;xxxxx, xxxxxxxxx and xxxxxxx and safely xxxxxxx xxxx information xxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxxxx xxxxxxx xx x&xxxx;xxxxx-xxxxxxx xxxxx (x.x. x&xxxx;xxxxx pursued xx xx xxxxxxxx xxxxxxxx xx by an xxxxxxx). Personnel xxxxxxxx xx xxxxx procedures xxxxx be xxxxxxxxxx xxxxxxx.

Xxxxxxxxxxx 1.13: Technical xxxxxxxxxx xxxxxx

X&xxxx;xxxxxxxxxxx’x xxxxxxxx xxxxxxxxxxx systems (x.x. xxxx office xxxxxxx, xxxxxxxx networks and xxxxxxxx xxxxxxx xxxxxxxxxxxx) xxxxx xx xxxxxxxxx xxxxxxxx for compliance xxxx xxx xxxxxxxxxxxx’x xxxxxxxxxxx framework xx xxxxxxxx (e.g. information xxxxxxxx policy, xxxxxxxxxxxxx xxxxxxx xxxxxx).

Xxxxxxxxxxx 1.14: Xxxxxxxxxxxxxx

Xxxxx xxxxxxx machines xxxxx comply xxxx xxx the security xxxxxxxx xxxx xxx xxx xxx xxxxxxxx xxxxxxxx xxx xxxxxxx (x.x. xxxxxxxxx, xxxxxxx). Xxxxxxxx relating xx xxxxxxxxxxx xxxx include: xxxxxxxxx xx xxx xxxxxxxxxx xxx xxx xxxxxxx operating xxxxxx, xxxxxxx xxxxxxxx, xxxxxx xxxxxxxxxx xx xxxxxxxxx xxxxxxxxxxxx (x.x. xxxxxxxxxx xxx development). Centralised xxxxxxxxxx, xxxxxxx xxx xxxxxxxxxx xx xxxx xx managing of xxxxxx xxxxxx, xx xxxxxxxxxx for high xxxxxxxxxx xxxxxxxx, xxxxx xx xxxxxxxxxxx xxxxx xx a risk xxxxxxxxxx. Xxxxx xxxxxxx xxxxxxxx xxxxxxx xx xxx xxxx xxxxxxxxxx xxxxx xxxx a similar xxxx xxxxxxx.

Xxxxxxxxxxx 1.15: Cloud xxxxxxxxx

Xxx xxxxx xx xxxxxx and/or xxxxxx xxxxx solutions xx xxx Xxxxxxx Xxxxxxxxxxx Xxxxx xxxx be xxxxx xx x&xxxx;xxxxxx xxxx xxxxxxxxxx, xxxxxx xxxx account the xxxxxxxxx xxxxxxxx and xxx contractual clauses xxxxxxx xx xxx xxxxx xxxxxxxx.

Xx hybrid xxxxx xxxxxxxxx xxx xxxx, xx xx xxxxxxxxxx xxxx the xxxxxxxxxxx level xx xxx xxxxxxx system xx xxx xxxxxxx xxx xx the xxxxxxxxx systems. Xxx xx-xxxxxxxx xxxxxxxxxx xx xxx hybrid xxxxxxxxx xxxx be segregated xxxx xxx xxxxx xx-xxxxxxxx systems.

Business xxxxxxxxxx xxxxxxxxxx (xxxxxxxxxx xxxx xx xxxxxxxx participants)

The xxxxxxxxx xxxxxxxxxxxx (2.1 xx 2.6) xxxxxx xx xxxxxxxx xxxxxxxxxx xxxxxxxxxx. Xxxx XXXXXX2 xxxxxxxxxxx xxxxxxxxxx by xxx Xxxxxxxxxx as xxxxx critical xxx xxx smooth xxxxxxxxxxx xx xxx XXXXXX2 xxxxxx xxxxx have x&xxxx;xxxxxxxx xxxxxxxxxx xxxxxxxx xx xxxxx comprising xxx xxxxxxxxx xxxxxxxx.

Xxxxxxxxxxx 2.1	:	Xxxxxxxx xxxxxxxxxx xxxxx xxxxx xx developed xxx xxxxxxxxxx xxx xxxxxxxxxxx xxxx are xx place.
Requirement 2.2	:	An xxxxxxxxx xxxxxxxxxxx xxxx xxxxx be available.
Requirement 2.3	:	Xxx xxxx xxxxxxx xx xxx xxxxxxxxx xxxx xxxxx xx xxxxxxxxx from xxxx xx the xxxxxxx xxxx, xx xxxxx xx avoid xxxx xxxx xxxxx xxx xxxxxxxx by xxx xxxx xxxxx xx xxx xxxx xxxx. Xxx xxxxxxx, xxx xxxxxxxxx xxxx xxxxx xx xx x&xxxx;xxxxxxxxx xxxxx grid xxx xxxxxxx xxxxxxxxxxxxxxxxx xxxxxxx xxxx xxxxx xx xxx primary xxxxxxxx xxxxxxxx.
Xxxxxxxxxxx 2.4	:	In xxx xxxxx xx a major xxxxxxxxxxx xxxxxxxxxx xxxxxxxxx xxx primary xxxx xxxxxxxxxxxx and/or xxxxxxxx xxxxx xxxxxxxxxxx, xxx xxxxxxxx participant shall xx xxxx xx xxxxxx normal xxxxxxxxxx xxxx xxx xxxxxxxxx xxxx, xxxxx it xxxxx xx xxxxxxxx xx xxxxxxxx xxxxx xxx xxxxxxxx day xxx xxxx the xxxxxxxxx xxxxxxxx day(s).
Requirement 2.5	:	Xxxxxxxxxx xxxxx be xx xxxxx xx xxxxxx xxxx xxx xxxxxxxxxx xx xxxxxxxxxxxx xx resumed xxxx xxx alternate site xxxxxx a reasonable xxxxxxxxx xxxxx xxx xxxxxxx xxxxxxxxxx xx service xxx xxxxxxxxxxxx xx xxx xxxxxxxxxxx xx xxx xxxxxxxx that xxx xxxxxxxxx.
Xxxxxxxxxxx 2.6	:	Xxx xxxxxxx xx cope xxxx xxxxxxxxxxx disruptions xxxxx be xxxxxx xx xxxxx xxxx x&xxxx;xxxx xxx xxxxxxxx xxxxx xxxxx be xxxxxxxxxxxxx xxxxxxx. Xxx xxxxxxx xxxxxx xxxxxxx xxxxx xxxxx xxx xxxxxx xxx xxxx.