1. Overview

SOV-4-08-C

The cloud service provider MUST document, define, and visualize (via a Data Flow Diagram) all data exchanges between the cloud service provider and third parties of cloud service derived data, cloud service customer data, and account data. The data exchanges MUST occur only via known gateways. The documentation MUST clearly identify data origins, destinations, transport protocols, data type and security mechanisms protecting these exchanges. The documentation MUST be reviewed and updated regularly, at least once a year. This documentation does not need to be published publicly.

1.1 References

1.2 Identified Requirements

1.2 Related Regulation

2. Identified Requirements

3. Related Regulations

• BSI C3A - Criteria enabling Cloud Computing Autonomy -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik

  C3A - Criteria enabling Cloud Computing Autonomy

  Published under Creative-Commons-License CC-BY-ND 4.0 International.