SIM-05 Duty of the Personnel to Report Security Incidents to a Central Body

The cloud service provider informs personnel and external business partners of their obligations. If necessary, they agree to or are contractually obliged to timely report all security events that become known to them and are directly related to the cloud service provided by the cloud service provider to a previously designated central office of the cloud service provider.

The cloud service provider communicates that 'false reports' of events that do not subsequently turn out to be incidents do not have any negative consequences.

The information security incident reporting mechanisms are communicated to personnel, cloud service customers and service organisations of the cloud service provider.

Cloud service customers ensure with suitable controls that identified security events, which the cloud service provider is required to process, are communicated timely to previously designated, responsible personnel.

The identification of such security events is supported by suitable controls (cf. complementary criterion for OPS-10).