Segregation of Duties

Conflicting tasks and responsibilities are separated based on an OIS-06 risk assessment to reduce the risk of unauthorised or unintended changes or misuse of cloud customer data processed, stored or transmitted in the cloud service.

The risk assessment covers the following areas, insofar as these are applicable to the provision of the Cloud Service and are in the area of responsibility of the Cloud Service Provider:

• Administration of rights profiles, approval and assignment of access and access authorisations (cf. IDM-01);
• Development, testing and release of changes (cf. DEV-01); and
• Operation of the system components.

If separation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions.

Additonal Criteria-Supplementary Information 

- About the CriteriaIdentified events that may constitute unauthorised or unintentional changes to or misuse of cloud customer data may, for example, be treated as a security incident, cf. SIM-01.

1. Vue d’ensemble

1.1 Références

• Risk Management Policy
• Policy for user accounts and access rights
• Policies for the development/procurement of information systems
• Policy for security incident management
• OIS-04 Segregation of Duties

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)