+Artikolu 18 2.

Artikolu 18 2.

Il-politika tas-sigurtà fiżika u ambjentali msemmija fil-paragrafu 1 għandha tinkludi dan kollu li ġej:

(a) 

referenza għat-taqsima tal-politika dwar il-kontroll tad-drittijiet tal-ġestjoni tal-aċċess imsemmija fl-Artikolu 21, l-ewwel paragrfu, il-punt (g);

(b) 

miżuri għall-protezzjoni mill-attakki, mill-aċċidenti u mit-theddid u l-perikli ambjentali, il-bini, iċ-ċentri tad-data tal-entità finanzjarja u ż-żoni ddeżinjati sensittivi identifikati mill-entità finanzjarja, fejn hemm l-assi tal-ICT u l-assi tal-informazzjoni;

(c) 

miżuri biex jiġu żgurati l-assi tal-ICT, kemm fil-bini tal-entità finanzjarja kif ukoll barra minnu, filwaqt li jitqiesu r-riżultati tal-valutazzjoni tar-riskju tal-ICT relatata mal-assi rilevanti tal-ICT;

(d) 

miżuri biex jiġu żgurati d-disponibbiltà, l-awtentiċità, l-integrità u l-kunfidenzjalità tal-assi tal-ICT, tal-assi tal-informazzjoni u tal-apparati ta’ kontroll fiżiku tal-aċċess tal-entità finanzjarja permezz tal-manutenzjoni xierqa;

(e) 

miżuri biex jiġu ppreżervati d-disponibbiltà, l-awtentiċità, l-integrità u l-kunfidenzjalità tad-data, inklużi:

(i) 

politika ta’ skrivanija żbarazzata għad-dokumenti;

(ii) 

politika ċara ta’ skrin vojt għall-faċilitajiet tal-ipproċessar tal-informazzjoni.

Għall-finijiet tal-punt (b), il-miżuri għall-protezzjoni mit-theddid u mill-perikli ambjentali għandhom ikunu proporzjonati mal-importanza tal-bini, taċ-ċentri tad-data, taż-żoni ddeżinjati sensittivi u mal-kritikalità tal-operazzjonijiet jew tas-sistemi tal-ICT li jinsabu fihom.

Għall-finijiet tal-punt (c), il-politika tas-sigurtà fiżika u ambjentali msemmija fil-paragrafu 1 għandu jkun fiha miżuri biex tiġi pprovduta protezzjoni xierqa għall-assi tal-ICT li jitħallew waħedhom.

1. Ħarsa ġenerali

,

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Standards relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Standards relatati

Standards
NOREA Physical and Environmental Security
Implement measures to safeguard the environment (premises, data centers, and sensitive designated areas) where important assets are located from attacks, accidents and from environmental threats and hazards. The level of protection from environmental threats should be commensurate with the importance of the asset storage location and the criticality of operations. Safeguard assets both within and outside the entity's premises, ensuring the Confidentiality, Integrity, and Availability (CIA) of these assets. These measures should be determined based on the outcomes of a risk assessment. This also includes practices like maintaining a clean desk and ensuring screens are clear at processing facilities and access to critical ICT assets. Identify and record authorized personnel entering critical locations of the financial entity. Grant physical access rights to critical ICT assets based on needtoknow, least privilege principles, and ad-hoc requirements according to the access management policy. Monitor physical access to premises, data centers, and designated sensitive areas, aligned with asset classification and area criticality. Regularly review and promptly revoke unnecessary physical access rights.
  • Builddate: 25.06.2024 00:00:00 -Doknr: CELEX:32024R1774
  • EULAW -

    EN: Legal acts of the European Union from EUR-Lex, https://eur-lex.europa.eu/. © European Union. Re-use is authorised by Decision 2011/833/EU, provided the source is acknowledged; the consolidated texts are licensed under CC BY 4.0 (EUR-Lex legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the legislation published in the Official Journal of the European Union is deemed authentic.

    DE: Rechtsakte der Europäischen Union aus EUR-Lex, https://eur-lex.europa.eu/. © Europäische Union. Weiterverwendung nach Beschluss 2011/833/EU mit Quellenangabe gestattet; die konsolidierten Fassungen stehen unter CC BY 4.0 (Rechtlicher Hinweis von EUR-Lex). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Verbindlich sind allein die im Amtsblatt der Europäischen Union veröffentlichten Rechtsakte.