OPS.3.1 Outsourcing for Service Providers

Outsourcing service providers MUST prepare rough concepts for the services they offer. These rough concepts MUST account for the framework conditions of the outsourcing in question, such as special requests. They MUST answer basic questions about the security level and the security requirements of outsourcing customers.

All the aspects of outsourcing projects SHOULD be agreed in writing with the respective outsourcing customers. All responsibilities and duties to collaborate on creating, reviewing, and changing these aspects (e.g. persons) SHOULD be specified within the framework of each agreement, or also directly in the security concepts between outsourcing service providers and their customers.

An outsourcing service provider SHOULD have a security concept for its services. For individual outsourcing projects, it SHOULD also establish specific security concepts based on the respective outsourcing customers' security requirements. Common security objectives SHOULD be developed between outsourcing service providers and their customers. A common classification for all sensitive information SHOULD also be established. Regular checks SHOULD be performed to ensure that the applicable security concepts are implemented.

The internal and external communication partners who may transmit and receive specific information on a given outsourcing project SHOULD be defined between the outsourcing service provider and the outsourcing customer. It SHOULD be checked at regular intervals whether the communication partners are still working in their respective roles. The corresponding authorisations SHOULD be adapted in the event of changes. Criteria that determine which communication partners may receive which information SHOULD be specified between the outsourcing partners at hand.

The employees of an outsourcing service provider SHOULD be instructed regarding their tasks and informed of outsourcing customers' existing information security regulations. Where required, the outsourcing service provider’s employees SHOULD be vetted in accordance with the customer's requirements (e.g. by means of a certificate of good conduct). The employees of the outsourcing service provider SHOULD be obliged in writing to comply with the relevant laws, regulations, confidentiality agreements, and internal provisions. Deputising arrangements SHOULD be implemented in all areas.

If an outsourcing service provider deploys external personnel, its outsourcing customers SHOULD be informed. External employees with responsibilities related to outsourcing SHOULD also be required in writing to comply with relevant laws, regulations, and internal rules. They SHOULD be briefed on their tasks, and in particular on security specifications. Third-party personnel deployed on short notice (or only once) SHOULD be treated as visitors. However, customers' security specifications SHOULD also be taken into account for third-party personnel.

A suitable client separation concept SHOULD ensure that the application and data contexts of different outsourcing customers are separated appropriately. Client separation concepts SHOULD be drawn up by outsourcing service providers and made available to their customers. Client separation concepts SHOULD provide sufficient security for the protection needs of outsourcing customers. The necessary client separation mechanisms SHOULD be implemented sufficiently by the outsourcing service provider.

Before a proprietary network is connected to the network of an outsourcing service provider, all the security-relevant aspects at hand SHOULD be specified in a written agreement. It SHOULD be defined who from one data network may access which areas and services of the other data network. Contact partners SHOULD be appointed on both sides for organisational and technical questions regarding the network connection. All security gaps identified SHOULD be eliminated and the required level of security SHOULD be verifiably achieved before the network connection is activated. In the event of security issues on one or both sides, it SHOULD be specified who must be informed and what escalation steps are to be initiated.

The required security safeguards SHOULD be agreed for the regular exchange of data among fixed communication partners of the outsourcing partners in question. Data formats and a secure form of data exchange SHOULD be defined. Contact persons SHOULD be appointed for organisational and technical questions. Appropriate contact persons SHOULD also be named for security-relevant events that occur when exchanging data with third parties. Availability and response times when exchanging data with third parties SHOULD be agreed. The types of exchanged data that can be used for specific purposes SHOULD also be defined.

The security concepts of outsourcing partners SHOULD be regularly checked to ensure that they are still up to date and consistent with each other. The status of the security safeguards agreed SHOULD be checked at regular intervals. Outsourcing partners SHOULD cooperate appropriately. They SHOULD also coordinate regularly on changes and improvements.

In addition, outsourcing partners SHOULD perform regular joint drills and tests. Information on security risks and how to handle them SHOULD be exchanged between outsourcing partners at regular intervals. A process SHOULD be a defined to secure the flow of information in case of security incidents that affect the contractual partners in question.

Site, system, and data access authorisations SHOULD be regulated for the employees of both outsourcing service providers and outsourcing customers. It SHOULD also be specified which authorisations are to be granted to auditors and other inspectors. Rights SHOULD always only be granted when they are necessary to perform a task. There SHOULD be a controlled procedure for granting, managing, and withdrawing authorisations.

There SHOULD be policies for making changes to IT components, software, and configuration data. When making changes, the relevant security aspects SHOULD also be considered. All changes MUST be planned, tested, approved, and documented. How and to what extent the changes are documented SHOULD be agreed with outsourcing customers. The documentation SHOULD be made available to outsourcing customers. Fallback solutions SHOULD be developed before changes are carried out. In the event of major security-relevant changes, the information security management department of the outsourcing organisation in question SHOULD already be involved in advance.

For the migration phase of a given outsourcing project, a security management team consisting of qualified employees of the outsourcing customer and the outsourcing service provider SHOULD be established. A security concept SHOULD be drawn up for the migration phase. Upon completion of the migration, the security concept SHOULD be updated. It SHOULD be ensured that all exceptions are reversed at the end of the migration phase. If there are changes during the migration phase, it SHOULD be checked whether the contractual basis and existing documents need to be adjusted accordingly.

There SHOULD be a contingency planning concept for outsourcing that comprises the components of the outsourcing customer and the outsourcing service provider in question, as well as the associated interfaces. The contingency planning concept for outsourcing SHOULD specify the responsibilities, contact persons, and processes between the outsourcing customer and the outsourcing service provider. Regular joint emergency drills SHOULD be performed.

If a contractual relationship with an outsourcing customer is terminated, the business activities of the customer and the outsourcing provider SHOULD NOT be affected. The outsourcing contract with the outsourcing customer SHOULD specify all aspects regarding the termination of the service relationship in question, including for both a planned and an unplanned end of the contractual relationship. The outsourcing service provider SHOULD return all the information and data of the outsourcing customer. The outsourcing service provider SHOULD then securely delete all data belonging to the customer. All authorisations configured within the framework of the outsourcing project in question SHOULD be reviewed and deleted if required.

The trustworthiness of an outsourcing service provider's new employees and external personnel SHOULD be checked with the help of appropriate certificates. To this end, criteria SHOULD be contractually stipulated with outsourcing customers.