+Organisation of Information Security (OIS)
---+Segregation of Duties
---+Contact with Relevant Government Agencies and Interest Groups
---+Risk Management Policy
---+Application of the Risk Management Policy
---+Information Security Management System (ISMS)
---+Information Security Policy
---+Interfaces and Dependencies

Organisation of Information Security (OIS)

None

1. Yleiskatsaus

Segregation of Duties

Conflicting tasks and responsibilities are separated based on an OIS-06 risk assessment to reduce the risk of unauthorised or unintended changes or misuse of cloud customer data processed, stored or transmitted in the cloud service.

The risk assessment covers the following areas, insofar as these are applicable to the provision of the Cloud Service and are in the area of responsibility of the Cloud Service Provider:

  • Administration of rights profiles, approval and assignment of access and access authorisations (cf. IDM-01);
  • Development, testing and release of changes (cf. DEV-01); and
  • Operation of the system components.

If separation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions.

Additonal Criteria-Supplementary Information 

- About the CriteriaIdentified events that may constitute unauthorised or unintentional changes to or misuse of cloud customer data may, for example, be treated as a security incident, cf. SIM-01.
Contact with Relevant Government Agencies and Interest Groups The Cloud Service Provider leverages relevant authorities and interest groups in order to stay informed about current threats and vulnerabilities. The information flows into the procedures for handling risks (cf. OIS06) and vulnerabilities (cf. OPS19).
Additonal CriteriaIf the cloud service is used by public sector organisations in Germany, the Cloud Service Provider leverages contacts with the National IT Situation Centre and the CERT Association of the BSI.
Supplementary Information - About the CriteriaRelevant contacts are for example:
• Federal Office for Information Security (BSI);
• OWASP Foundation; and
• CERT networks DFNCERT, TFCSIRT etc.
Public sector organisations in Germany are e.g. authorities and ministries.
Risk Management Policy Policies and instructions for risk management procedures are documented, communicated and provided in accordance with SP-01 for the following aspects:
• Identification of risks associated with the loss of confidentiality, integrity, availability and authenticity of information within the scope of the ISMS and assigning risk owners;
• Analysis of the probability and impact of occurrence and determination of the level of risk;
• Evaluation of the risk analysis based on defined criteria for risk acceptance and prioritisation of handling;
• Handling of risks through measures, including approval of authorisation and acceptance of residual risks by risk owners; and
• Documentation of the activities implemented to enable consistent, valid and comparable results.
Additonal Criteria-
Supplementary Information - About the CriteriaThe risk level can be determined by qualitative, semi-quantitative and quantitative methods (cf. ISO 31010) based on the likelihood and impacts.
Application of the Risk Management Policy The Cloud Service Provider executes the process for handling risks as needed or at least once a year. The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the Cloud Service Provider:
• Processing, storage or transmission of data of cloud customers with different protection needs;
• Occurrence of vulnerabilities and malfunctions in technical protective measures for separating shared resources;
• Attacks via access points, including interfaces accessible from public networks;
• Conflicting tasks and areas of responsibility that cannot be separated for organisational or technical reasons; and
• Dependencies on subservice organisations.
The analysis, evaluation and treatment of risks, including the approval of actions and acceptance of residual risks, is reviewed for adequacy at least annually by the risk owners.
Additonal Criteria-
Supplementary Information - About the CriteriaThis criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the Cloud Service Provider. Requirements for measures to manage these risks can be found in the criteria area “Control and Monitoring of Service Providers and Suppliers (SSO)”.
Shared resources are e.g. networks, RAM or storage.
Information Security Management System (ISMS) The Cloud Service Provider operates an information security management system (ISMS) in accordance with ISO/IEC 27001. The scope of the ISMS covers the Cloud Service Provider's organisational units, locations and procedures for providing the cloud service.The measures for setting up, implementing, maintaining and continuously improving the ISMS are documented.The documentation includes:
• Scope of the ISMS (Section 4.3 of ISO/IEC 27001);
• Declaration of applicability (Section 6.1.3), and
• Results of the last management review (Section 9.3).
Additonal CriteriaThe Information Security Management System (ISMS) has a valid certification according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz.
Supplementary Information - About the CriteriaThe basic criterion can also be fulfilled without valid certification of the ISMS according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz, if the submitted documentation meets the requirements of ISO/IEC 27001.
Information Security Policy The top management of the Cloud Service Provider has adopted an information security policy and communicated it to internal and external employees as well as cloud customers.The policy describes:
• the importance of information security, based on the requirements of cloud customers in relation to information security;
• the security objectives and the desired security level, based on the business goals and tasks of the Cloud Service Provider;
• the most important aspects of the security strategy to achieve the security objectives set; and
• the organisational structure for information security in the ISMS application area.
Additonal Criteria-
Supplementary Information - About the CriteriaThe top management is a natural person or group of persons who make the final decision for the institution and is responsible for that decision.
Interfaces and Dependencies Interfaces and dependencies between cloud service delivery activities performed by the Cloud Service Provider and activities performed by third parties are documented and communicated. This includes dealing with the following events:
• Vulnerabilities;
• Security incidents; and
• Malfunctions.
The type and scope of the documentation is geared towards the information requirements of the subject matter experts of the affected organisations in order to carry out the activities appropriately (e.g. definition of roles and responsibilities in guidelines, description of cooperation obligations in service descriptions and contracts).
The communication of changes to the interfaces and dependencies takes place in a timely manner so that the affected organisations and third parties can react appropriately with organisational and technical measures before the changes take effect.
Additonal Criteria-
Supplementary Information - About the CriteriaThe Cloud Service Provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, Cloud customers' obligations to cooperate should be described in service descriptions and contracts.
Third parties in the sense of this basic criterion are, e.g. cloud customers and sub-service providers.

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

Vaatimukset

3. Liittyvät säädökset

Säädökset