+Identification of Vulnerabilities of the Cloud Service

Identification of Vulnerabilities of the Cloud Service

The Cloud Service Provider applies appropriate measures to check the cloud service for vulnerabilities which might have been integrated into the cloud service during the software development process.
The procedures for identifying such vulnerabilities are part of the software development process and, depending on a risk assessment, include the following activities:
• Static Application Security Testing;
• Dynamic Application Security Testing;
• Code reviews by the Cloud Service Provider's subject matter experts; and
• Obtaining information about confirmed vulnerabilities in software libraries provided by third parties and used in their own cloud service.
The severity of identified vulnerabilities is assessed according to defined criteria and measures are taken to immediately eliminate or mitigate them.
Additonal CriteriaThe procedures for identifying such vulnerabilities also include annual code reviews or security penetration tests by qualified external third parties.
Supplementary Information - About the CriteriaKnown vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the Cloud Service Provider's software development process are the subject of criteria OPS23 (Management of vulnerabilities, malfunctions and errors open vulnerability assessment).

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai