+Monitoring of compliance with requirements

Monitoring of compliance with requirements

The Cloud Service Provider monitors compliance with information security requirements and applicable legal and regulatory requirements in accordance with policies and instructions concerning controlling and monitoring of third-parties.
Monitoring includes a regular review of the following evidence to the extent that such evidence is to be provided by third parties in accordance with the contractual agreements:
• reports on the quality of the service provided;
• certificates of the management systems' compliance with international standards;
• independent thirdparty reports on the suitability and operating effectiveness of their servicerelated internal control systems; and
• Records of the third parties on the handling of vulnerabilities, security incidents and malfunctions.
The frequency of the monitoring corresponds to the classification of the third party based on the risk assessment conducted by the Cloud Service Provider (cf. SSO-02). The results of the monitoring are included in the review of the third party's risk assessment.
Identified violations and deviations are subjected to analysis, evaluation and treatment in accordance with the risk management procedure (cf. OIS-07).
Additonal CriteriaThe procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects:
• Configuration of system components;
• Performance and availability of system components;
• Response time to malfunctions and security incidents; and
• Recovery time (time until completion of error handling).
Identified violations and discrepancies are automatically reported to the responsible personnel or system components of the Cloud Service Provider for prompt assessment and action.
Supplementary Information - About the CriteriaEvidence for the review of the suitability and operating effectiveness of the service-related internal control system include reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.
In the evidence provided by the third parties, the Cloud Service Provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions:
• The scope and the validity respectively the period covered by the evidence;
• For attestation reports: Qualifications of the opinion, included deviations/other observations including management's response and corresponding controls to be implemented and executed by the Cloud Service Provider;
• Disclosed subcontractors incl. any changes among those (e.g. additional subcontractor); and
• Stated security incidents.

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

Nõuded

3. Seotud regulatsioonid

Regulatsioonid