|
The cloud service provider maintains a directory for controlling and monitoring the service organisations that contribute services to the delivery of the cloud service. The following information is maintained in the directory: 1. Company name; 2. Address of the head office; 3. Applicable legal jurisdiction; 4. Locations where cloud service customer data, cloud service derived data, cloud service provider data and account data is processed and stored; 5. Responsible contact group/person at the service organisation; 6. Responsible contact group/person at the cloud service provider; 7. Description of the service; 8. Classification based on the risk assessment; 9. Beginning of service usage; and 10. Proof of compliance with contractually agreed requirements. Supplementary information It is not necessary to maintain a single central register in order to fulfil the basic criterion.
|