+Compliance (COM)
---+Identification of applicable legal, regulatory, self-imposed or contractual requirements
---+Policy for planning and conducting audits
---+Internal audits of the information security management system
---+Information on information security performance and management assessment of the ISMS

Compliance (COM)

None

1. Resumen

Identification of applicable legal, regulatory, self-imposed or contractual requirements The legal, regulatory, self-imposed and contractual requirements relevant to the information security of the cloud service as well as the Cloud Service Provider's procedures for complying with these requirements are explicitly defined and documented.
Additonal Criteria-
Supplementary Information - About the CriteriaThe Cloud Service Provider's documentation may refer to the following requirements, among others:
• Requirements for the protection of personal data (e.g. EU General Data Protection Regulation);
• Compliance requirements based on contractual obligations with cloud customers (e.g. ISO/IEC 27001, SOC 2, PCI-DSS);
• generally accepted accounting principles (e.g. in accordance with HGB or IFRS);
• Requirements regarding access to data and auditability of digital documents (e.g. according to GDPdU); and
• Other laws (e.g. according to BSIG or AktG).
Policy for planning and conducting audits Policies and instructions for planning and conducting audits are documented, communicated and made available in accordance with SP-01 and address the following aspects:
• Restriction to read-only access to system components in accordance with the agreed audit plan and as necessary to perform the activities;
• Activities that may result in malfunctions to the cloud service or breaches of contractual requirements are performed during scheduled maintenance windows or outside peak periods; and
• Logging and monitoring of activities.
Additonal CriteriaThe Cloud Service Provider grants its cloud customers contractually guaranteed information and audit rights.
Supplementary Information - About the Criteria-
Internal audits of the information security management system Subject matter experts check the compliance of the information security management system at regular intervals, at least annually, with the relevant and applicable legal, regulatory, selfimposed or contractual requirements (cf. COM01) as well as compliance with the policies and instructions (cf. SP01) within their scope of responsibility (cf. OIS01) through internal audits (cf. § 9.2 of ISO/IEC 27001).
Identified vulnerabilities and deviations are subject to risk assessment in accordance with the risk management procedure (cf. OIS06) and followup measures are defined and tracked (cf. OPS-18).
Additonal CriteriaInternal audits are supplemented by procedures to automatically monitor applicable requirements of policies and instructions with regard to the following aspects:
• Configuration of system components to provide the cloud service within the Cloud Service Provider's area of responsibility;
• Performance and availability of these system components;
• Response time to malfunctions and security incidents;
• Recovery time (time to completion of error handling);
Identified vulnerabilities and deviations are automatically reported to the appropriate Cloud Service Provider’s subject matter experts for immediate assessment and action.
Cloud customers can view compliance with selected contractual requirements in real time.
Supplementary Information - About the CriteriaSubject matter experts operate, e.g., in the Cloud Service Provider's internal revision department or expert third parties commissioned by the Cloud Service Provider, such as auditing companies, and may hold relevant certifications such as "Certified Internal Auditor (CIA)".
With regard to ISMS compliance, see Section 9.2 of ISO/IEC 27001.
Information on information security performance and management assessment of the ISMS The top management of the Cloud Service Provider is regularly informed about the information security performance within the scope of the ISMS in order to ensure its continued suitability, adequacy and effectiveness. The information is included in the management review of the ISMS at is performed at least once a year.
Additonal Criteria-
Supplementary Information - About the CriteriaThe top management is a natural person or group of people who make final decisions for the institution and are responsible for these.
The aspects to be dealt with in the management review of the ISMS are listed in Section 9.3 of ISO / IEC 27001.

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones