+Portability and Interoperability (PI)
---+Documentation and safety of input and output interfaces
---+Contractual agreements for the provision of data
---+Secure deletion of data

Portability and Interoperability (PI)

None

1. Übersicht

Documentation and safety of input and output interfaces The cloud service can be accessed by other cloud services or IT systems of cloud customers through documented inbound and outbound interfaces. Further, the interfaces are clearly documented for subject matter experts on how they can be used to retrieve the data.
Communication takes place through standardised communication protocols that ensure the confidentiality and integrity of the transmitted information according to its protection requirements. Communication over untrusted networks is encrypted according to CRY-02.
The type and scope of the documentation on the interfaces is geared to the needs of the cloud customers' subject matter experts in order to enable the use of these interfaces. The information is maintained in such a way that it is applicable for the cloud service's version which is intended for productive use.
Additonal Criteria-
Supplementary Information - About the Criteria-
Contractual agreements for the provision of data In contractual agreements, the following aspects are defined with regard to the termination of the contractual relationship, insofar as these are applicable to the cloud service:
• Type, scope and format of the data the Cloud Service Provider provides to the cloud customer;
• Definition of the timeframe, within which the Cloud Service Provider makes the data available to the cloud customer
• Definition of the point in time as of which the Cloud Service Provider makes the data inaccessible to the cloud customer and deletes these; and
• The cloud customers' responsibilities and obligations to cooperate for the provision of the data.
The definitions are based on the needs of subject matter experts of potential customers who assess the suitability of the cloud service with regard to a dependency on the Cloud Service Provider as well as legal and regulatory requirements.
Additonal CriteriaThe design of the aspects is based on legal and regulatory requirements in the environment of the Cloud Service Provider. The Cloud Service Provider identifies the requirements regularly, at least once a year, and checks these for actuality and adjusts the contractual agreements accordingly.
Supplementary Information - About the CriteriaThe type and scope of the data and the responsibilities for its provision depend on the service model of the cloud service or the services and functions provided:
In the case of IaaS and PaaS, the cloud customer is generally responsible for extracting and backing up the data which is stored in the cloud service before termination of the contractual relationship (cf. complementary requirement).
The Cloud Service Provider's responsibility is typically limited to the provision of data for the configuration of the infrastructure or platform that the cloud customer has set up within its environment (e.g. configuration of networks, images of virtual machines and containers).
With SaaS, the cloud customer typically relies on export functions provided by the Cloud Service Provider. Data created by the cloud customer should be available in the same format as stored in the cloud service. Other data, including relevant log files and metadata, should be available in an applicable standard format, such as CSV, JSON or XML.
In Germany, legal requirements for retention can be found, for example, in the German Tax Code (§147 AO) and the German Commercial Code (§257 HGB). These provide for a retention obligation of six or ten years.
Secure deletion of data The Cloud Service Provider's procedures for deleting the cloud customers' data upon termination of the contractual relationship ensure compliance with the contractual agreements (cf. PI-02).
The deletion includes data in the cloud customer's environment, metadata and data stored in the data backups.
The deletion procedures prevent recovery by forensic means.
Additonal Criteria-
Supplementary Information - About the CriteriaSuitable methods for data deletion are e.g. multiple overwriting or deletion of the encryption key.

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen