+Policies and instructions for controlling and monitoring third parties

Policies and instructions for controlling and monitoring third parties

Policies and instructions for controlling and monitoring third parties (e.g. service providers or suppliers) whose services contribute to the provision of the cloud service are documented, communicated and provided in accordance with SP-01 with respect to the following aspects:
• Requirements for the assessment of risks resulting from the procurement of third-party services;
• Requirements for the classification of third parties based on the risk assessment by the Cloud Service Provider and the determination of whether the third party is a subcontractor (cf. Supplementary Information);
• Information security requirements for the processing, storage or transmission of information by third parties based on recognised industry standards;
• Information security awareness and training requirements for staff;
• applicable legal and regulatory requirements;
• Requirements for dealing with vulnerabilities, security incidents and malfunctions;
• Specifications for the contractual agreement of these requirements;
• Specifications for the monitoring of these requirements; and
• Specifications for applying these requirements also to service providers used by the third parties, insofar as the services provided by these service providers also contribute to the provision of the cloud service.
Additonal CriteriaSubservice organisations of the Cloud Service Provider are contractually obliged to provide regular reports by independent auditors on the suitability of the design and operating effectiveness of their service-related internal control system.
The reports include the complementary subservice organisations that are required, together with the controls of the Cloud Service Provider, to meet the applicable basic criteria of BSI C5 with reasonable assurance.
In case no reports can be provided, the Cloud Service Provider agrees appropriate information and audit rights to assess the suitability and effectiveness of the service-related internal control system, including the complementary controls, by qualified personnel.
Supplementary Information - About the CriteriaReports by independent auditors on the suitability of the design and operating effectiveness of their service-related internal control system are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.
Qualified personnel works, for example, in the Cloud Service Provider's internal audit department or is commissioned by the Cloud Service Provider in form of expert third parties, such as audit firms, and may hold relevant certifications such as "Certified Internal Auditor (CIA)".
The complementary controls at the sub-service provider are necessary in order to, together with the controls of the Cloud Service Provider, fulfil the applicable C5 criteria with reasonable assurance.
Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright.
If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subcontractors, these regulations remain unaffected by the C5 criteria.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni