+Application of the Risk Management Policy

Application of the Risk Management Policy

The Cloud Service Provider executes the process for handling risks as needed or at least once a year. The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the Cloud Service Provider:
• Processing, storage or transmission of data of cloud customers with different protection needs;
• Occurrence of vulnerabilities and malfunctions in technical protective measures for separating shared resources;
• Attacks via access points, including interfaces accessible from public networks;
• Conflicting tasks and areas of responsibility that cannot be separated for organisational or technical reasons; and
• Dependencies on subservice organisations.
The analysis, evaluation and treatment of risks, including the approval of actions and acceptance of residual risks, is reviewed for adequacy at least annually by the risk owners.
Additonal Criteria-
Supplementary Information - About the CriteriaThis criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the Cloud Service Provider. Requirements for measures to manage these risks can be found in the criteria area “Control and Monitoring of Service Providers and Suppliers (SSO)”.
Shared resources are e.g. networks, RAM or storage.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations