+Security Incident Management (SIM)
---+Processing of security incidents
---+Documentation and reporting of security incidents
---+Duty of the users to report security incidents to a central body
---+Evaluation and learning process
---+Policy for security incident management

Security Incident Management (SIM)

None

1. Oversigt

Processing of security incidents Subject matter experts of the Cloud Service Provider, together with external security providers where appropriate, classify, prioritise and perform root-cause analyses for events that could constitute a security incident.
Additonal CriteriaThe Cloud Service Provider simulates the identification, analysis and defence of security incidents and attacks at least once a year through appropriate tests and exercises (e.g. Red Team training).
Supplementary Information - About the Criteria-
Documentation and reporting of security incidents After a security incident has been processed, the solution is documented in accordance with the contractual agreements and the report is sent to the affected customers for final acknowledgement or, if applicable, as confirmation.
Additonal CriteriaThe customer can either actively approve solutions or the solution is automatically approved after a certain period.
Information on security incidents or confirmed security breaches is made available to all affected customers.
The contract between the Cloud Service Provider and the cloud customer regulates which data is made available to the cloud customer for his own analysis in the event of security incidents.
Supplementary Information - About the Criteria-
Duty of the users to report security incidents to a central body The Cloud Service Provider informs employees and external business partners of their obligations. If necessary, they agree to or are contractually obliged to report all security events that become known to them and are directly related to the cloud service provided by the Cloud Service Provider to a previously designated central office of the Cloud Service Provider promptly.
In addition, the Cloud Service Provider communicates that "false reports" of events that do not subsequently turn out to be incidents do not have any negative consequences.
Additonal Criteria-
Supplementary Information - About the Criteria-
Evaluation and learning process Mechanisms are in place to measure and monitor the type and scope of security incidents and to report them to support agencies. The information obtained from the evaluation is used to identify recurrent or significant incidents and to identify the need for further protection.
Additonal Criteria-
Supplementary Information - About the CriteriaSupporting bodies may be external service providers or government agencies such as the BSI.
Policy for security incident management Policies and instructions with technical and organisational safeguards are documented, communicated and provided in accordance with SP-01 to ensure a fast, effective and proper response to all known security incidents.
The Cloud Service Provider defines guidelines for the classification, prioritisation and escalation of security incidents and creates interfaces to the incident management and business continuity management.
In addition, the Cloud Service Provider has set up a "Computer Emergency Response Team" (CERT), which contributes to the coordinated resolution of occurring security incidents.
Customers affected by security incidents are informed in a timely and appropriate manner.
Additonal CriteriaThere are instructions as to how the data of a suspicious system can be collected in a conclusive manner in the event of a security incident. In addition, there are analysis plans for typical security incidents and an evaluation methodology so that the collected information does not lose its evidential value in any subsequent legal assessment.
Supplementary Information - About the Criteria-

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer