+Asset Management (AM)
---+Asset Inventory
---+Acceptable Use and Safe Handling of Assets Policy
---+Commissioning of Hardware
---+Decommissioning of Hardware
---+Commitment to Permissible Use, Safe Handling and Return of Assets
---+Asset Classification and Labelling

Asset Management (AM)

None

1. Apžvalga

Asset Inventory The Cloud Service Provider has established procedures for inventorying assets.
The inventory is performed automatically and/or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset lifecycle.
Assets are recorded with the information needed to apply the Risk Management Procedure (Cf. OIS-07), including the measures taken to manage these risks throughout the asset lifecycle. Changes to this information are logged.
Additonal CriteriaLogging and monitoring applications take into account the information collected on the assets in order to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud customers in accordance with contractual agreements.
Supplementary Information - About the CriteriaAssets within the meaning of this criteria area are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the Cloud Service Provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers.
These objects consist of hardware and software objects:Hardware objects are
• Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and
• As well as end devices if the Cloud Service Provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication).
Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs).
The lifecycle of an asset includes:
• Acquisition;
• Commissioning;
• Maintenance;
• Decommissioning; and
• Disposal.
Acceptable Use and Safe Handling of Assets Policy Policies and instructions for acceptable use and safe handling of assets are documented, communicated and provided in accordance with SP-01 and address the following aspects of the asset lifecycle as applicable to the asset:
• Approval procedures for acquisition, commissioning, maintenance, decommissioning, and disposal by authorised personnel or system components;
• Inventory;
• Classification and labelling based on the need for protection of the information and measures for the level of protection identified;
• Secure configuration of mechanisms for error handling, logging, encryption, authentication and authorisation;
• Requirements for versions of software and images as well as application of patches;
• Handling of software for which support and security patches are not available anymore;
• Restriction of software installations or use of services;
• Protection against malware;
• Remote deactivation, deletion or blocking;
• Physical delivery and transport;
• dealing with incidents and vulnerabilities; and
• Complete and irrevocable deletion of the data upon decommissioning.
Additonal Criteria-
Supplementary Information - About the Criteria-
Commissioning of Hardware The Cloud Service Provider has an approval process for the use of hardware to be commissioned, which is used to provide the cloud service in the production environment, in which the risks arising from the commissioning are identified, analysed and mitigated. Approval is granted after verification of the secure configuration of the mechanisms for error handling, logging, encryption, authentication and authorisation according to the intended use and based on the applicable policies.
Additonal Criteria-
Supplementary Information - About the CriteriaThe basic criterion applies only to physical hardware objects, such as servers, storage systems, and network components.
Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV).
The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.
Decommissioning of Hardware The decommissioning of hardware used to operate system components supporting the cloud service production environment under the responsibility of the Cloud Service Provider requires approval based on the applicable policies.
The decommissioning includes the complete and permanent deletion of the data or proper destruction of the media.
Additonal Criteria-
Supplementary Information - About the CriteriaThe deletion of data or physical destruction of data mediums can take place, for example, according to DIN 66399 or BSI IT-Grundschutz module CON.6.
Commitment to Permissible Use, Safe Handling and Return of Assets The Cloud Service Provider's internal and external employees are provably committed to the policies and instructions for acceptable use and safe handling of assets before they can be used if the Cloud Service Provider has determined in a risk assessment that loss or unauthorised access could compromise the information security of the Cloud Service.
Any assets handed over are provably returned upon termination of employment.
Additonal CriteriaPhysical assets of internal and external employees are managed centrally.
Central management enables software, data, and policy distribution, as well as remote deactivation, deletion, or locking.
Supplementary Information - About the CriteriaThe basic criterion essentially concerns mobile devices (e.g. notebooks, tablets, smartphones, etc.), where confidential information is stored on them which can be used in the event of unauthorised access to obtain privileged access to the cloud service (e.g. if these are used as security tokens for authentication).
Asset Classification and Labelling Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the information it processes, stores, or transmits.
The need for protection is determined by the individuals or groups responsible for the assets of the Cloud Service Provider according to a uniform schema. The schema provides levels of protection for the confidentiality, integrity, availability, and authenticity protection objectives.
Additonal CriteriaLogging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority. Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
Supplementary Information - About the CriteriaIf the Cloud Service Provider does not make a differentiated classification of the assets, all assets are to be assigned to the highest defined protection requirement.

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai