DEV-14 Secure Use of Third Party Hardware and Software

Policies and procedures for the use of third party and open source software are documented, communicated and provided in accordance with SP-01.

Supplementary information

The policy should consider, where applicable, the same aspects as the policy for the proper and secure use of assets (cf. AM-05).

For the hardware and software products (cf. DEV-13) used in the development of the cloud service, a list of dependencies to those products is maintained.

Only trusted sources are used to retrieve third party software. Whenever possible, the authenticity of the software is verified.

In procurement for the development of the cloud service, the cloud service provider performs a risk assessment in accordance with OIS-07 for every hardware and software product.