+Control and Monitoring of Service Providers and Suppliers (SSO)
---+Policies and instructions for controlling and monitoring third parties
---+Risk assessment of service providers and suppliers
---+Directory of service providers and suppliers
---+Monitoring of compliance with requirements
---+Exit strategy for the receipt of benefits

Control and Monitoring of Service Providers and Suppliers (SSO)

None

1. Áttekintés

Policies and instructions for controlling and monitoring third parties Policies and instructions for controlling and monitoring third parties (e.g. service providers or suppliers) whose services contribute to the provision of the cloud service are documented, communicated and provided in accordance with SP-01 with respect to the following aspects:
• Requirements for the assessment of risks resulting from the procurement of third-party services;
• Requirements for the classification of third parties based on the risk assessment by the Cloud Service Provider and the determination of whether the third party is a subcontractor (cf. Supplementary Information);
• Information security requirements for the processing, storage or transmission of information by third parties based on recognised industry standards;
• Information security awareness and training requirements for staff;
• applicable legal and regulatory requirements;
• Requirements for dealing with vulnerabilities, security incidents and malfunctions;
• Specifications for the contractual agreement of these requirements;
• Specifications for the monitoring of these requirements; and
• Specifications for applying these requirements also to service providers used by the third parties, insofar as the services provided by these service providers also contribute to the provision of the cloud service.
Additonal CriteriaSubservice organisations of the Cloud Service Provider are contractually obliged to provide regular reports by independent auditors on the suitability of the design and operating effectiveness of their service-related internal control system.
The reports include the complementary subservice organisations that are required, together with the controls of the Cloud Service Provider, to meet the applicable basic criteria of BSI C5 with reasonable assurance.
In case no reports can be provided, the Cloud Service Provider agrees appropriate information and audit rights to assess the suitability and effectiveness of the service-related internal control system, including the complementary controls, by qualified personnel.
Supplementary Information - About the CriteriaReports by independent auditors on the suitability of the design and operating effectiveness of their service-related internal control system are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.
Qualified personnel works, for example, in the Cloud Service Provider's internal audit department or is commissioned by the Cloud Service Provider in form of expert third parties, such as audit firms, and may hold relevant certifications such as "Certified Internal Auditor (CIA)".
The complementary controls at the sub-service provider are necessary in order to, together with the controls of the Cloud Service Provider, fulfil the applicable C5 criteria with reasonable assurance.
Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright.
If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subcontractors, these regulations remain unaffected by the C5 criteria.
Risk assessment of service providers and suppliers Service providers and suppliers of the Cloud Service Provider undergo a risk assessment in accordance with the policies and instructions for the control and monitoring of third parties prior to contributing to the delivery of the cloud service. The adequacy of the risk assessment is reviewed regularly, at least annually, by qualified personnel of the Cloud Service Provider during service usage.
The risk assessment includes the identification, analysis, evaluation, handling and documentation of risks with regard to the following aspects:
• Protection needs regarding the confidentiality, integrity, availability and authenticity of information processed, stored or transmitted by the third party;
• Impact of a protection breach on the provision of the cloud service;
• The Cloud Service Provider's dependence on the service provider or supplier for the scope, complexity and uniqueness of the service purchased, including the consideration of possible alternatives.
Additonal Criteria-
Supplementary Information - About the Criteria-
Directory of service providers and suppliers The Cloud Service Provider maintains a directory for controlling and monitoring the service providers and suppliers who contribute services to the delivery of the cloud service. The following information is maintained in the directory:
• Company name;
• Address;
• Locations of data processing and storage;
• Responsible contact person at the service provider/supplier;
• Responsible contact person at the cloud service provider;
• Description of the service;
• Classification based on the risk assessment;
• Beginning of service usage; and
• Proof of compliance with contractually agreed requirements.
The information in the list is checked at least annually for completeness, accuracy and validity.
Additonal Criteria-
Supplementary Information - About the CriteriaIt is not necessary to maintain a single central register in order to fulfil the basic criterion.
Monitoring of compliance with requirements The Cloud Service Provider monitors compliance with information security requirements and applicable legal and regulatory requirements in accordance with policies and instructions concerning controlling and monitoring of third-parties.
Monitoring includes a regular review of the following evidence to the extent that such evidence is to be provided by third parties in accordance with the contractual agreements:
• reports on the quality of the service provided;
• certificates of the management systems' compliance with international standards;
• independent thirdparty reports on the suitability and operating effectiveness of their servicerelated internal control systems; and
• Records of the third parties on the handling of vulnerabilities, security incidents and malfunctions.
The frequency of the monitoring corresponds to the classification of the third party based on the risk assessment conducted by the Cloud Service Provider (cf. SSO-02). The results of the monitoring are included in the review of the third party's risk assessment.
Identified violations and deviations are subjected to analysis, evaluation and treatment in accordance with the risk management procedure (cf. OIS-07).
Additonal CriteriaThe procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects:
• Configuration of system components;
• Performance and availability of system components;
• Response time to malfunctions and security incidents; and
• Recovery time (time until completion of error handling).
Identified violations and discrepancies are automatically reported to the responsible personnel or system components of the Cloud Service Provider for prompt assessment and action.
Supplementary Information - About the CriteriaEvidence for the review of the suitability and operating effectiveness of the service-related internal control system include reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.
In the evidence provided by the third parties, the Cloud Service Provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions:
• The scope and the validity respectively the period covered by the evidence;
• For attestation reports: Qualifications of the opinion, included deviations/other observations including management's response and corresponding controls to be implemented and executed by the Cloud Service Provider;
• Disclosed subcontractors incl. any changes among those (e.g. additional subcontractor); and
• Stated security incidents.
Exit strategy for the receipt of benefits The Cloud Service Provider has defined and documented exit strategies for the purchase of services where the risk assessment of the service providers and suppliers regarding the scope, complexity and uniqueness of the purchased service resulted in a very high dependency (cf. Supplementary Information).
Exit strategies are aligned with operational continuity plans and include the following aspects:
• Analysis of the potential costs, impacts, resources and timing of the transition of a purchased service to an alternative service provider or supplier;
• Definition and allocation of roles, responsibilities and sufficient resources to perform the activities for a transition;
• Definition of success criteria for the transition; and
• Definition of indicators for monitoring the performance of services, which should initiate the withdrawal from the service if the results are unacceptable.
Additonal Criteria-
Supplementary Information - About the CriteriaA very high dependency can be assumed in the following situations in particular:
• The purchased service is absolutely required for the provision of the cloud service – this situation is given when the Cloud Service Provider:
- provides the cloud service from data centres operated by third parties; and
- provides a SaaS service and uses the IaaS or PaaS of another Cloud Service Provider.
• The service cannot be obtained within one month from an alternative service provider or supplier, as:
- It is unique on the market and no other supplier can deliver it;
- It is strongly individualised by the service provider or supplier and/or the Cloud Service Provider;
- It cannot be supplied by any other provider in the required quality of service; and
- It requires specific knowledge that is only/mainly available to the current service provider or supplier and not to the Cloud Service Provider.

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

Követelmények

3. Kapcsolódó szabályozások

Szabályozások