Operations (OPS)

None

1. Apžvalga

Pavadinimas	Standartas
Capacity Management - Planning	The planning of capacities and resources (personnel and IT resources) follows an established procedure in order to avoid possible capacity bottlenecks. The procedures include forecasting future capacity requirements in order to identify usage trends and manage system overload. Cloud Service Providers take appropriate measures to ensure that they continue to meet the requirements agreed with cloud customers for the provision of the cloud service in the event of capacity bottlenecks or outages regarding personnel and IT resources, in particular those relating to the dedicated use of system components, in accordance with the respective agreements. Additonal CriteriaThe forecasts are considered in accordance with the service level agreement for planning and preparing the provisioning. Supplementary Information - About the CriteriaFor economic reasons, Cloud Service Providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources must still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the Cloud Service Provider, the Cloud Service Provider must be able to explain the procedures at least orally within the scope of this audit. Cloud customers must use appropriate controls to ensure that the capacity and resource requirements to be covered by the Cloud Service Provider are planned and reflected in the SLA with the Cloud Service Provider. The requirements can also be reviewed regularly through appropriate controls and the SLA can be adjusted accordingly.
Capacity Management - Monitoring	Technical and organisational safeguards for the monitoring and provisioning and de-provisioning of cloud services are defined. Thus, the Cloud Service Provider ensures that resources are provided and/or services are rendered according to the contractual agreements and that compliance with the service level agreements is ensured. Additonal CriteriaTo monitor capacity and availability, the relevant information is available to the cloud customer in a self-service portal. Supplementary Information - About the CriteriaTechnical and organisational measures typically include: • Use of monitoring tools with alarm function when defined threshold values are exceeded; • Process for correlating events and interface to incident management; • Continuous monitoring of the systems by qualified personnel; and • Redundancies in the IT systems.
Capacity Management - Controlling of Resources	Depending on the capabilities of the respective service model, the cloud customer can control and monitor the allocation of the system resources assigned to the customer for administration/use in order to avoid overcrowding of resources and to achieve sufficient performance. Additonal Criteria- Supplementary Information - About the CriteriaResources according to the possibilities of the service model are for example • Computing capacity; • Storage capacity; • Configuration of network properties; • Application Programming Interfaces (APIs); and • Databases.
Protection Against Malware - Concept	Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: • Use of system-specific protection mechanisms; • Operating protection programs on system components under the responsibility of the Cloud Service Provider that are used to provide the cloud service in the production environment; and • Operation of protection programs for employees' terminal equipment. Additonal CriteriaThe Cloud Service Provider creates regular reports on the checks performed, which are reviewed and analysed by authorised bodies or committees. Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware. Updates are applied at the highest frequency that the vendor(s) contractually offer(s). Supplementary Information - About the CriteriaProtection programs for employee devices can be, for example, server-based protection programs that scan files in attachments on the server or filter network traffic.
Protection Against Malware - Implementation	System components under the Cloud Service Provider's responsibility that are used to deploy the cloud service in the production environment are configured with malware protection according to the policies and instructions. If protection programs are set up with signature and behaviour-based malware detection and removal, these protection programs are updated at least daily. Additonal CriteriaThe configuration of the protection mechanisms is monitored automatically. Deviations from the specifications are automatically reported to the responsible authorities so that they can be immediately assessed and the necessary measures taken. Supplementary Information - About the CriteriaProtection against malicious programs can be implemented by operating system~~specific protection mechanisms or explicit protection programs (e.g. for signature~~ and behaviour-based detection and removal of malicious programs).
Data Protection and Recovery - Concept	Policies and instructions for data backup and recovery are documented, communicated and provided in accordance with SP-01 regarding the following aspects. • The extent and frequency of data backups and the duration of data retention are consistent with the contractual agreements with the cloud customers and the Cloud Service Provider's operational continuity requirements for Recovery Time Objective (RTO) and Recovery Point Objective (RPO); • Data is backed up in encrypted, stateofthe-art form; • Access to the backed-up data and the execution of restores is performed only by authorised persons; and • Tests of recovery procedures (cf. OPS-08). Additonal Criteria- Supplementary Information - About the CriteriaThe data backup concept specifies which type of data backup is to be carried out (e.g. type, manner, duration) and specifies which data must also be backed up in special cases (e.g. pure use of compute nodes without data storage). When backing up data, a distinction must be made between backups and snapshots of virtual machines. Snapshots do not replace backups, but can be part of the backup strategy to achieve Recovery Point Objectives (RPO) if they are additionally stored outside the original data location. The business requirements of the Cloud Service Provider for the scope, frequency and duration of the data backup result from the business impact analysis (cf. BCM-03) for development and operational processes of the cloud service. If different data backup and recovery procedures exist for data under the responsibility of the cloud customer and the Cloud Service Provider, both variants must be included in a test according to this criteria catalogue. For procedures to secure the data of the Cloud Service Provider, only the adequacy and implementation of the controls must be proven, but not their effectiveness. For procedures to secure the data of cloud customers, proof of effectiveness must also be provided.
Data Backup and Recovery - Monitoring	The execution of data backups is monitored by technical and organisational measures. Malfunctions are investigated by qualified staff and rectified promptly to ensure compliance with contractual obligations to cloud customers or the Cloud Service Provider's business requirements regarding the scope and frequency of data backup and the duration of storage. Additonal CriteriaThe relevant logs or summarised results are available to the cloud customer in a self-service portal for monitoring the data backup. Supplementary Information - About the CriteriaIf the data backup is not part of the contract concluded between the Cloud Service Provider and the cloud customer, this criterion is not applicable. The Cloud Service Provider must present this situation transparently in the system description.
Data Backup and Recovery - Regular Testing	Restore procedures are tested regularly, at least annually. The tests allow an assessment to be made as to whether the contractual agreements as well as the specifications for the maximum tolerable downtime (Recovery Time Objective, RTO) and the maximum permissible data loss (Recovery Point Objective, RPO) are adhered to (cf. BCM-02). Deviations from the specifications are reported to the responsible personnel or system components so that these can promptly assess the deviations and initiate the necessary actions. Additonal CriteriaAt the customer's request, the Cloud Service Provider inform the cloud customer of the results of the recovery tests. Recovery tests are embedded in the Cloud Service Provider's emergency management. Supplementary Information - About the CriteriaIf the data backup is not part of the contract concluded between the Cloud Service Provider and the cloud customer, this criterion is not applicable. The Cloud Service Provider must present this situation transparently in the system description.
Data Backup and Recovery - Storage	The Cloud Service Provider transfers data to be backed up to a remote location or transports these on backup media to a remote location. If the data backup is transmitted to the remote location via a network, the data backup or the transmission of the data takes place in an encrypted form that corresponds to the stateofthe-art. The distance to the main site is chosen after sufficient consideration of the factors recovery times and impact of disasters on both sites. The physical and environmental security measures at the remote site are at the same level as at the main site. Additonal Criteria- Supplementary Information - About the CriteriaIf the data backup is not part of the contract concluded between the Cloud Service Provider and the cloud customer, this criterion is not applicable. The Cloud Service Provider must present this situation transparently in the system description. A remote location can be e.g. another data centre of the Cloud Service Provider.
Logging and Monitoring - Concept	The Cloud Service Provider has established policies and instructions that govern the logging and monitoring of events on system components within its area of responsibility. These policies and instructions are documented, communicated and provided according to SP-01 with respect to the following aspects: • Definition of events that could lead to a violation of the protection goals; • Specifications for activating, stopping and pausing the various logs; • Information regarding the purpose and retention period of the logs. • Define roles and responsibilities for setting up and monitoring logging; • Time synchronisation of system components; and • Compliance with legal and regulatory frameworks. Additonal Criteria- Supplementary Information - About the CriteriaLegal and regulatory frameworks can define e.g. legal requirements for retention and deletion of data.
Logging and Monitoring - Metadata Management Concept	Policies and instructions for the secure handling of metadata (usage data) are documented, communicated and provided according to SP-01 with regard to the following aspects: • Metadata is collected and used solely for billing, incident management and security incident management purposes; • Exclusively anonymous metadata to deploy and enhance the cloud service so that no conclusions can be drawn about the cloud customer or user; • No commercial use; • Storage for a fixed period reasonably related to the purposes of the collection; • Immediate deletion if the purposes of the collection are fulfilled and further storage is no longer necessary. • Provision to cloud customers according to contractual agreements. Additonal CriteriaPersonal data is automatically removed from the log data before the Cloud Service Provider processes it as far as technically possible. The removal is done in a way that allows the Cloud Service Provider to continue to use the log data for the purpose for which it was collected. Supplementary Information - About the CriteriaMetadata is all data that is generated by the Cloud Service Provider through the use of its service by the cloud customer and is not content-related data. This includes login/logout times, IP addresses, customer's GPS location, which resources (network, storage, computer) were used, which data was accessed when, with whom data was shared, with whom it was communicated, etc. This data is partly used for billing purposes and for (security) incident management. However, it can also be used to analyse customer behaviour (depending on the cloud service) and to make the decision making and work processes visible to the Cloud Service Provider. The criteria aim to provide a transparent and clear definition of the collection and use of metadata. In addition, metadata refers to data that is generated when the Cloud Service Provider accesses customer data (e.g. for indexing).
Logging and Monitoring - Access, Storage and Deletion	The requirements for the logging and monitoring of events and for the secure handling of metadata are implemented by technically supported procedures with regard to the following restrictions: • Access only for authorised users and systems; • Retention for the specified period; and • Deletion when further retention is no longer necessary for the purpose of collection. Additonal Criteria- Supplementary Information - About the Criteria-
Logging and Monitoring - Identification of Events	The logging data is automatically monitored for events that may violate the protection goals in accordance with the logging and monitoring requirements. This also includes the detection of relationships between events (event correlation). Identified events are automatically reported to the appropriate departments for prompt evaluation and action. Additonal Criteria- Supplementary Information - About the Criteria-
Logging and Monitoring - Storage of the Logging Data	The Cloud Service Provider retains the generated log data and keeps these in an appropriate, unchangeable and aggregated form, regardless of the source of such data, so that a central, authorised evaluation of the data is possible. Log data is deleted if it is no longer required for the purpose for which they were collected. Between logging servers and the assets to be logged, authentication takes place to protect the integrity and authenticity of the information transmitted and stored. The transfer takes place using stateofthe~~art encryption or a dedicated administration network (out~~of-band management). Additonal CriteriaThe Cloud Service Provider provides a customer-specific logging (in terms of scope and duration of retention period) upon request of the Cloud Customer. Depending on the protection requirements of the Cloud Service Provider and the technical feasibility, a logical or physical separation of log and customer data is carried out. Supplementary Information - About the Criteria-
Logging and Monitoring - Accountability	The log data generated allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of a security incident. Interfaces are available to conduct forensic analyses and perform backups of infrastructure components and their network communication. Additonal CriteriaOn request of the Cloud customer, the Cloud Service Provider provides the logs relating to the cloud customer in an appropriate form and in a timely manner so that the cloud customer can investigate any incidents relating to them. Supplementary Information - About the CriteriaInfrastructure components in the sense of this criterion are e.g. fabric controllers, network components and virtualisation servers.
Logging and Monitoring - Configuration	Access to system components for logging and monitoring in the Cloud Service Provider’s area of responsibility is restricted to authorised users. Changes to the configuration are made in accordance with the applicable policies (cf. DEV-03). Additonal CriteriaAccess to system components for logging and monitoring in the Cloud Service Provider's area of responsibility requires two-factor authentication. Supplementary Information - About the Criteria-
Logging and Monitoring - Availability of the Monitoring Software	The Cloud Service Provider monitors the system components for logging and monitoring in its area of responsibility. Failures are automatically and promptly reported to the Cloud Service Provider’s responsible departments so that these can assess the failures and take required action. Additonal CriteriaThe system components for logging and monitoring are designed in such a way that the overall functionality is not restricted if individual components fail. Supplementary Information - About the Criteria-
Managing Vulnerabilities, Malfunctions and Errors - Concept	Guidelines and instructions with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure the timely identification and addressing of vulnerabilities in the system components used to provide the cloud service. These guidelines and instructions contain specifications regarding the following aspects: • Regular identification of vulnerabilities; • Assessment of the severity of identified vulnerabilities; • Prioritisation and implementation of actions to promptly remediate or mitigate identified vulnerabilities based on severity and according to defined timelines; and • Handling of system components for which no measures are initiated for the timely remediation or mitigation of vulnerabilities. Additonal Criteria- Supplementary Information - About the CriteriaIdentified vulnerabilities can be classified according to established metrics such as CVSS or OWASP. The decision not to remediate or mitigate identified vulnerabilities must be made by the Cloud Service Provider based on a risk assessment. If necessary, risk-compensating measures must be taken.
Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests	The Cloud Service Provider has penetration tests carried out by qualified internal personnel or external service providers at least once a year. The penetration tests are carried out according to a documented test methodology and include the system components relevant to the provision of the cloud service in the area of responsibility of the Cloud Service Provider, which have been identified as such in a risk analysis. The Cloud Service Provider assess the severity of the findings made in penetration tests according to defined criteria. For findings with medium or high criticality regarding the confidentiality, integrity or availability of the cloud service, actions must be taken within defined time windows for prompt remediation or mitigation. Additonal CriteriaThe tests are carried out every six months. They must always be performed by independent external auditors. Internal personnel for penetration tests may support the external service providers. Supplementary Information - About the CriteriaVulnerabilities should be classified according to damage potential and a period of time should be specified for the required response. The following classification according to the BSI publication "Ein Praxis~~Leitfaden für IS~~Penetrationstests" can serve as an orientation: • High: Immediate reaction; • Medium: Short-term response; • Low: Medium-term response; and • Information: Long-term response.
Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures	The Cloud Service Provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness. Results are evaluated at least quarterly by accountable departments at the Cloud Service Provider to initiate continuous improvement actions and to verify their effectiveness. Additonal Criteria- Supplementary Information - About the CriteriaCommon Vulnerabilities and Exposures (CVE) or similar methods are a suitable way of documenting vulnerabilities and incidents.
Involvement of Cloud customers in the event of incidents	The Cloud Service Provider periodically informs the cloud customer on the status of incidents affecting the cloud customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements. As soon as an incident has been resolved from the Cloud Service Provider's perspective, the cloud customer is informed according to the contractual agreements, about the actions taken. Additonal Criteria- Supplementary Information - About the Criteria-
Testing and Documentation of known Vulnerabilities	System components in the area of responsibility of the Cloud Service Provider for the provision of the cloud service are automatically checked for known vulnerabilities at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18), the severity is assessed in accordance with defined criteria and measures for timely remediation or mitigation are initiated within defined time windows. Additonal CriteriaAvailable security patches are applied depending on the severity of the vulnerabilities, as determined based on the latest version of the Common Vulnerability Scoring System (CVSS): • Critical (CVSS = 9.0 - 10.0): 3 hours; • High (CVSS = 7.0 - 8.9): 3 days; • Average (CVSS = 4.0 - 6.9): 1 month; • Low (CVSS = 0.1 - 3.9): 3 months. Supplementary Information - About the CriteriaIn contrast to penetration tests (Cf. OPS~~20), which are carried out manually and according to an individual scheme, the check for open vulnerabilities is performed automatically, using so~~called vulnerability scanners.
Managing Vulnerabilities, Malfunctions and Errors - System Hardening	System components in the production environment used to provide the cloud service under the Cloud Service Provider's responsibility are hardened according to generally accepted industry standards. The hardening requirements for each system component are documented. If non-modifiable ("immutable") images are used, compliance with the hardening specifications as defined in the hardening requirements is checked upon creation of the images. Configuration and log files regarding the continuous availability of the images are retained. Additonal CriteriaSystem components in the Cloud Service Provider's area of responsibility are automatically monitored for compliance with hardening specifications. Deviations from the specifications are automatically reported to the appropriate departments of the Cloud Service Provider for immediate assessment and action. Supplementary Information - About the CriteriaSystem components in the sense of the basic criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the Cloud Service Provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events. The configuration and log files for non-modifiable mages include e.g.: • Configuration of the images used with regards to implemented hardening; and specifications including version history • Logs for file integrity monitoring of images in productive use. Generally accepted industry standards are, for example, the Security Configuration Benchmark of the “Centre for Internet Security” (CIS) or the corresponding modules in the BSI IT~~Grundschutz~~Kompendium. Compliance with hardening specifications can be monitored with e.g. file integrity monitoring
Separation of Datasets in the Cloud Infrastructure	Cloud customer data stored and processed on shared virtual and physical resources is securely and strictly separated according to a documented approach based on OIS-07 risk analysis to ensure the confidentiality and integrity of this data. Additonal CriteriaResources in the storage network are segmented by secure zoning (LUN binding and LUN masking). Supplementary Information - About the CriteriaShared resources include memory, cores and storage networks. Technical segregation (separation) of the stored and processed data of cloud customers into shared resources can be achieved through firewalls, access lists, tagging, VLANs, virtualisation and measures in the storage network (e.g. LUN binding and LUN masking). Where the adequacy and effectiveness of segregation cannot be assessed with reasonable assurance (e.g. due to complex implementation), evidence may also be provided through expert third party review results (e.g. penetration tests to validate the concept). The segregation of transmitted data is subject to control COS-06.

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai
Šaltinis	Reikalavimas

3. Susiję teisės aktai

Teisės aktai
Šaltinis	Reguliavimas

BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)