OPS.2.2 Cloud Usage

A strategy MUST be established for cloud usage. It MUST define the objectives, opportunities, and risks that a given organisation associates with cloud use. In addition, the legal and organisational framework conditions and the technical requirements arising from the use of cloud services MUST be examined. The results of this investigation MUST be documented in a feasibility study.

The services to be purchased from a cloud service provider in the future MUST be documented along with the chosen delivery model. In addition, it MUST be ensured that all fundamental aspects of technical and organisational security are sufficiently considered in the planning phase for cloud use.

A rough individual security analysis SHOULD be carried out for the planned cloud service. This SHOULD be repeated if technical and organisational framework conditions change significantly. For larger cloud projects, a roadmap SHOULD also be developed to determine when and how a cloud service will be deployed.

A security policy for cloud usage MUST be created based on an organisation's strategy for cloud usage. It MUST include specific security requirements for implementing cloud services within the organisation. It MUST also document specific security requirements for the cloud service provider and the defined level of protection for cloud services in terms of confidentiality, integrity and availability. If cloud services from international providers are used, the special country-specific requirements and legal regulations at hand MUST be taken into account.

Cloud customers MUST develop a service definition for each cloud service they intend to use. All the cloud services planned and used SHOULD also be documented.

Based on their service definitions for cloud services, cloud customers MUST identify and document all the interfaces and responsibilities relevant to cloud usage. The differentiation between the responsibilities of a given customer and its cloud service provider MUST be clearly evident.

Before migrating to a cloud service, cloud customers SHOULD draw up a migration concept. To this end, organisational regulations and the distribution of tasks SHOULD first be defined. In addition, existing business processes that will be affected by the planned cloud usage SHOULD be identified and adjusted accordingly. It SHOULD be ensured that an organisation's own IT is sufficiently considered in the migration process. Those in charge SHOULD also determine whether the organisation's employees should receive additional training.

Before using a cloud service, organisations SHOULD carefully plan how it is to be integrated into their IT. For this purpose, they SHOULD check (at minimum) whether adaptations of interfaces, network connections, or the administration and data management models at hand are necessary. The results SHOULD be documented and updated at regular intervals.

Cloud customers SHOULD develop a security concept for the use of cloud services based on the security requirements they have identified (see OPS.2.2.A2 Drawing Up a Security Policy for Cloud Usage).

Cloud customers SHOULD create a detailed requirements profile for their future cloud service provider based on their service definition of the cloud service they intend to use. A service specification and a requirements specification SHOULD be drawn up. Supplementary sources of information SHOULD also be used to assess cloud service providers. The service descriptions available from cloud service providers SHOULD also be carefully examined and reviewed.

The contractual provisions between cloud customers and cloud service providers SHOULD be adapted in terms of their type, scope, and level of detail to the protection needs of the information to be used in the cloud. The location in which the cloud service provider renders its services SHOULD be specified. In addition, escalation levels and communication channels SHOULD be defined between a given organisation and its cloud service provider. The manner in which the organisation's data should be securely deleted SHOULD also be agreed. Termination provisions SHOULD also be established in writing. Cloud service providers SHOULD disclose all the subcontractors they require to provide their service.

An organisation's migration to a cloud service SHOULD take place on the basis of its established migration concept. Whether its security concept for cloud usage needs to be adapted to potential new requirements SHOULD be checked during the migration. All preventive safeguards for emergencies SHOULD also be complete and up to date.

The migration to a cloud service SHOULD first be verified in a test run. Once the cloud service has gone live, it SHOULD be checked whether the cloud service provider meets the cloud customer's defined requirements.

Cloud customers SHOULD create a contingency concept for the cloud services they use. It SHOULD contain all the necessary information about responsibilities and contact persons. In addition, detailed rules SHOULD be drawn up for backups. The specifications for redundant management tools and interface systems SHOULD also be recorded.

Cloud customers SHOULD regularly update all the documentation and policies they have created for the cloud services in use. Cloud customers SHOULD also periodically check whether their cloud service providers are rendering the contractually guaranteed services. Cloud service providers and their customers SHOULD also coordinate regularly if possible. Plans SHOULD be made and drills carried out on how to respond to system failures.

Cloud customers SHOULD have their cloud service providers regularly prove that the agreed security requirements are being met. Such evidence SHOULD be based on an internationally recognised set of rules (e.g. IT-Grundschutz, ISO/IEC 27001, Compliance Control Catalogue (C5), Cloud Controls Matrix of the Cloud Security Alliance). Cloud customers SHOULD check whether the scope and protection needs cover the cloud services used.

If a cloud service provider uses subcontractors to provide its cloud services, it SHOULD regularly demonstrate to its cloud customers that they are performing the necessary audits.

If a cloud customer terminates its service relationship with a cloud service provider, it SHOULD ensure that this will not interfere with its business operations or processes. Contracts with cloud service providers SHOULD regulate how the service relationship in question can be terminated in an orderly manner.

Cloud customers SHOULD define all the requirements necessary to change cloud service providers or bring the cloud service or data back into their own IT infrastructure. Cloud customers SHOULD also conduct regular portability tests. Contracts with cloud service providers SHOULD include specifications to ensure the necessary portability.

Cloud customers SHOULD check whether they should create their own data backups in addition to the contractually specified data backups of their cloud service providers. In addition, they SHOULD create detailed requirements for a backup service.

If data is encrypted by a cloud service provider, the encryption mechanisms and key lengths that may be used SHOULD be contractually agreed. If the customer’s own encryption mechanisms are used, suitable key management SHOULD be ensured. The encryption SHOULD take into account any special features of the selected cloud service model.

Customers SHOULD check whether Federation Services are being used in their cloud computing projects.

It SHOULD be ensured that a Security Assertion Markup Language (SAML) ticket only transmits the necessary information to the cloud service provider in question. Authorisations SHOULD be checked regularly so that only authorised users are issued an SAML ticket.

It SHOULD be contractually agreed with external cloud service providers that appropriate checks will be carried out to ensure that the personnel used are qualified and trustworthy. To this end, providers and customers SHOULD work together to define corresponding criteria.