+SP-02.01B

SP-02.01B

Information security policies and procedures are reviewed for adequacy by the cloud service provider's subject matter experts at least annually, and in case of significant changes to the cloud service. The review shall consider at least the following aspects:

1. Organisational and technical changes in the procedures for providing the cloud service; and

2. Legal and regulatory changes in the cloud service provider's environment.

Supplementary information

During an ISO 27001 certification audit, the controls to this criteria are most likely also tested. If it is a joint audit (C5 and ISO), efficiency of audit-once-certify-many may be gained here. If it is a separate audit, the auditor of the C5 attestation engagement can choose to inspect the ISO report instead of testing the control again, if the provided evidence is conclusive enough.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen

Gekoppelde issues

Koppelingen
is blocked by Periodic Review & Update of Security, Compliance & Resilience Program
is blocked by Statutory, Regulatory & Contractual Compliance