SSO-08 Controlling Exchanges with Suppliers of Functional Components

When functional components used for the provision of the cloud service may directly or indirectly access cloud service customer data, the cloud service provider defines and implements a policy according to SP-01 that does not allow a direct exchange between such components and their suppliers.

Supplementary information

A supplier of a functional component is typically a service organisation of the cloud service provider. The authorisation for the transfer may be automated. Content provided by the supplier refers to updates of the functional components.

In addition, procedures are defined and implemented according to SP-01 that require the cloud service provider to authorise any content provided by a supplier for its functional components or to be sent from a functional component to its supplier. The authorisation takes place before the content is transferred and for each transfer.

Supplementary information

A supplier of a functional component is typically a service organisation of the cloud service provider. The authorisation for the transfer may be automated. Content provided by the supplier refers to updates of the functional components.

When a procedure for authorising content before its transfer is automated, the cloud service provider implements it using a solution that maintains traces of:

1. The operations that are proposed by the functional component's supplier;

2. The verification that is performed to authorise the content before its transfer; and

3. The transfers, both incoming and outgoing, that are effectively performed.

Supplementary information

A supplier of a functional component is typically a service organisation of the cloud service provider. The authorisation for the transfer may be automated. Content provided by the supplier refers to updates of the functional components.