+Documentation, communication and provision of policies and instructions

Documentation, communication and provision of policies and instructions

Policies and instructions (incl. concepts and guidelines) are derived from the information security policy and are documented according to a uniform structure. They are communicated and made available to all internal and external employees of the Cloud Service Provider in an appropriate manner.
The policies and instructions are version controlled and approved by the top management of the Cloud Service Provider or an authorised body.
The policies and instructions describe at least the following aspects:
• Objectives;
• Scope;
• Roles and responsibilities, including staff qualification requirements and the establishment of substitution rules;
• Roles and dependencies on other organisations (especially cloud customers and subservice organisations);
• Steps for the execution of the security strategy; and
• Applicable legal and regulatory requirements.
Additonal Criteria-
Supplementary Information - About the CriteriaThe appropriateness of the demand-oriented communication and provision must be assessed against the size and complexity of the Cloud Service Provider's organisation and the type of cloud service offered. Possible criteria are:
• Integration of guidelines and instructions in the onboarding of new employees
• Training and information campaigns when adopting new or revising existing policies and instructions
• Form of provision
Policies and instructions are required for the following basic criteria in which the content is specified in more detail:
• Risk management policy (OIS-06)
• Acceptable use and handling of assets policy (AM-02)
• Security requirements for premises and buildings (PS-01)
• Physical site access control (PS-04)
• Concept for protection against malware (OPS-04)
• Concept for data protection and recovery (OPS-06)
• Concept for logging and monitoring (OPS-10)
• Concept for meta data handling (OPS-11)
• Concept for handling of vulnerabilities, malfunctions and errors (OPS-18)
• Policy for system and data access authorisations (IDM-01)
• Policy for the use of encryption procedures and key management (CRY-01)
• Policies for data transmission (COS-08)
• Policies for the development/procurement of information systems (DEV-01)
• Policies for changes to information systems (DEV-03)
• Policies and instructions for controlling and monitoring third parties (SSO-01)
• Policy for security incident management (SIM-01)
• Business impact analysis policies and procedures (BCM-02)
• Policy for planning and conducting audits (COM-02)

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni