+COM-02.02B

COM-02.02B

Risk-based policies and procedures for planning and conducting audits are documented, communicated and made available in accordance with SP-01 and address the following aspects in order to prevent adversal effects on the operation of the cloud service from the audit:

1. Restriction to read-only access to system components in accordance with the agreed audit plan and as necessary to perform the activities;

2. Activities that may result in outages, degradations of the cloud service or breaches of contractual requirements are performed during scheduled maintenance windows or outside peak periods;

3. Logging and monitoring of activities;

4. Review of server and network equipment configurations under the responsibility of the cloud service provider;

5. Intrusion testing for external access points; and

6. Source code reviews of internally developed security features.

Supplementary information

See DEV-05 for further explanation on security features.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by Publishing Security, Compliance & Resilience Documentation
is blocked by Functional Review Of Security, Compliance & Resilience Controls
is blocked by Executive Leadership Oversight of Security, Compliance & Resilience Controls
is blocked by Audit Planning Activities
is blocked by Content of Event Logs
is blocked by Least Privilege
is blocked by Static Code Analysis
is blocked by External Vulnerability Assessment
is blocked by Penetration Testing
is blocked by Static Code Analysis
is blocked by Static Code Analysis