OPS.2.1 Outsourcing for Customers

All the security requirements for an outsourcing project MUST be defined on the basis of an outsourcing strategy. Both outsourcing parties MUST contractually commit to comply with IT-Grundschutz or a comparable level of protection. All interfaces between the outsourcing service provider and the outsourcing customer MUST be identified and corresponding security requirements defined in this regard. The security requirements MUST specify the authorisations (e.g. site, system, and data access rights) that the two parties are to grant to one another.

Employee Representatives SHOULD be informed of an outsourcing project in good time. Employee Representatives SHOULD be involved from the tender phase onwards. Depending on the outsourcing project in question, the statutory rights of co-determination SHOULD be taken into consideration.

A requirements profile containing the security requirements for a given outsourcing project SHOULD be created for selecting an outsourcing service provider. Assessment criteria for the outsourcing service provider and its staff SHOULD also exist. These SHOULD be based on the requirements profile.

All aspects of an outsourcing project SHOULD be agreed in writing with the outsourcing service provider in question. In addition, all roles and duties of cooperation for the creation, review, and modification of a security concept SHOULD be regulated with the outsourcing service provider (e.g. if personnel changes occur). The rights and obligations of the contractual parties SHOULD be agreed in writing. For the purpose of checking compliance with the requirements at hand on a regular basis, the outsourcing service provider SHOULD enable the outsourcing customer to conduct audits.

A strategy for outsourcing SHOULD be defined. This SHOULD take into account the economic, technical, organisational, and legal framework conditions, as well as the relevant aspects of information security. The business processes, tasks, or applications generally associated with outsourcing SHOULD be clarified. An outsourcing customer SHOULD retain sufficient skills, competencies, and resources to be able to determine and control the information security requirements for each outsourcing project on its own. An outsourcing strategy SHOULD describe the goals, opportunities, and risks of the corresponding outsourcing project.

An outsourcing customer SHOULD draw up an information security concept based on the associated security requirements for each of its outsourcing projects. Every outsourcing service provider SHOULD also provide an individual security concept for the respective outsourcing project. The two security concepts SHOULD be coordinated. The outsourcing service provider's security concept and its implementation SHOULD be merged into an overall security concept. The outsourcing customer or independent third parties SHOULD regularly check the effectiveness of the security concept.

The internal and external communication partners who may transmit and receive specific information about a given outsourcing project SHOULD be defined. There SHOULD be a process that can be used to check the functions of the communication partners on both sides. The admissible communication partners and their respective authorisations MUST always be documented and kept up to date.

The employees of an outsourcing service provider SHOULD be obliged in writing to comply with relevant laws, regulations, and the outsourcing customer's rules. The employees of the outsourcing service provider SHOULD be briefed on their tasks and informed of existing information security regulations in a controlled manner. Deputising rules SHOULD be in place for the employees of the outsourcing service provider. There SHOULD be a controlled process that defines how the outsourcing service provider terminates its contractual relationships with its employees. Third-party personnel of the outsourcing service provider who are used on a short-term or one-off basis SHOULD be treated as visitors.

Before the network of an outsourcing customer is connected to the network of its outsourcing service provider, all security-relevant aspects SHOULD be agreed in writing. The agreement SHOULD specifically define the areas and services to which the outsourcing service provider will be granted access in the network of the outsourcing customer. The affected areas SHOULD be suitably separated from each other. Compliance with the network connection agreements SHOULD be checked and documented. Contact persons SHOULD be appointed on both sides for organisational and technical questions about the network connection. The required security level SHOULD be ensured and verified with the outsourcing service provider before the network connection to the outsourcing service provider is activated. If there are security issues on one or both sides, it SHOULD be specified who must be informed and what escalation steps are to be initiated.

The security safeguards required for regular exchanges of data with fixed communication partners SHOULD be agreed. Data formats and approaches for the secure exchange of data SHOULD also be defined. There SHOULD be contact persons for organisational and technical problems. Contact persons SHOULD also be named for any security-relevant events that occur when exchanging data with third parties. Availability and response times SHOULD be agreed for data exchanges with third parties. It SHOULD be defined which exchanged data may be used for what purposes.

An operational concept SHOULD be drawn up which also takes the security aspects of a given outsourcing project into account. The security concepts of the outsourcing partners SHOULD be regularly checked to ensure that they are up to date and consistent with each other. The status of the security safeguards agreed SHOULD be checked at regular intervals. There SHOULD be regular communication between the outsourcing partners. Proposals for changes and improvements SHOULD be discussed and agreed regularly.

The outsourcing partners SHOULD perform regular joint drills and tests to maintain the established level of security. Information on security risks and how to handle them SHOULD be exchanged between the outsourcing partners at regular intervals. A process SHOULD be a defined to secure the flow of information in case of security incidents that affect the contractual partners in question.

Outsourcing customers SHOULD be given sufficient notice of major changes. Outsourcing customers SHOULD regularly request documentation of all significant changes regarding planning, testing, approval, and documentation. Before any changes are made, fallback solutions SHOULD be developed in cooperation with the outsourcing service provider.

For the migration phase of a given outsourcing project, a security management team consisting of qualified employees of the outsourcing customer and the outsourcing service provider SHOULD be established. For the migration phase, a preliminary security concept SHOULD be drawn up that also considers the test and introduction phase. It SHOULD be ensured that production data is not used as test data in an unprotected manner during the migration phase. All changes SHOULD be documented. Upon completion of the migration, the security concept SHOULD be updated. It SHOULD be ensured that all exceptions are reversed at the end of the migration phase. In the event of changes during the migration phase, the extent to which the contractual basis has to be adapted SHOULD be checked.

A contingency planning concept for outsourcing SHOULD exist that covers the components of the outsourcing customer and the outsourcing service provider in question, as well as the associated interfaces and communication channels. The contingency planning concept for outsourcing SHOULD specify the responsibilities, contact persons, and processes between the outsourcing customer and the outsourcing service provider. The outsourcing customer SHOULD monitor whether the outsourcing service provider has implemented the business continuity safeguards defined. Outsourcing customers and service providers SHOULD conduct joint emergency drills for this purpose.

Contracts with outsourcing service providers SHOULD specify all aspects regarding the termination of the service relationship concerned, including for both planned and unplanned termination. The business of an outsourcing customer SHOULD NOT be affected if its service relationship with its outsourcing service provider is terminated.

All information and data SHOULD be returned to the outsourcing customer upon termination. The outsourcing service provider SHOULD securely delete all related data once this information and data has been returned.

There SHOULD be contractual agreements with outsourcing service providers that state that the trustworthiness of the personnel deployed will be checked appropriately. To this end, providers and customers SHOULD work together to define corresponding criteria.