+Personnel (HR)
---+Verification of qualification and trustworthiness
---+Employment terms and conditions
---+Security training and awareness programme
---+Disciplinary measures
---+Responsibilities in the event of termination or change of employment
---+Confidentiality agreements

Personnel (HR)

None

1. Visão geral

Verification of qualification and trustworthiness The competency and integrity of all internal and external employees of the Cloud Service Provider with access to cloud customer data or system components under the Cloud Service Provider's responsibility who are responsible to provide the cloud service in the production environment shall be verified prior to commencement of employment in accordance with local legislation and regulation by the Cloud Service Provider.
To the extent permitted by law, the review will cover the following areas:
• Verification of the person through identity card;
• Verification of the CV;
• Verification of academic titles and degrees;
• Request of a police clearance certificate for applicants;
• Certificate of good conduct or national equivalent; and
• Evaluation of the risk to be blackmailed.
Additonal Criteria-
Supplementary Information - About the CriteriaExternal employees in the sense of the criteria are those who perform activities in accordance with the processes and procedures of the Cloud Service Provider. Employees of subservice providers who perform activities according to the subservice own processes and procedures are not covered by this criterion.
The verification of qualification and trustworthiness can be supported by a specialised service provider. Depending on national legislation, national equivalents of the German certificate of good conduct may also be permitted. The assessment of the extent to which a potential employee can be blackmailed can be carried out, for example, by checking his creditworthiness.
Employment terms and conditions The Cloud Service Provider's internal and external employees are required by the employment terms and conditions to comply with applicable policies and instructions relating to information security.
The information security policy, and the policies and instructions based on it, are to be acknowledged by the internal and external personnel in a documented form before access is granted to any cloud customer data or system components under the responsibility of the Cloud Service Provider used to provide the cloud service in the production environment.
Additonal Criteria-
Supplementary Information - About the CriteriaThe Cloud Service Provider ensures that the policies and instructions reflect applicable legal and regulatory requirements in accordance with SP-01.
Security training and awareness programme The Cloud Service Provider operates a target group-oriented security awareness and training program, which is completed by all internal and external employees of the Cloud Service Provider on a regular basis. The program is regularly updated based on changes to policies and instructions and the current threat situation and includes the following aspects:
• Handling system components used to provide the cloud service in the production environment in accordance with applicable policies and procedures;
• Handling cloud customer data in accordance with applicable policies and instructions and applicable legal and regulatory requirements;
• Information about the current threat situation; and
• Correct behaviour in the event of security incidents.
Additonal CriteriaThe learning outcomes achieved through the awareness and training programme are measured and evaluated in a target group-oriented manner. The measurements cover quantitative and qualitative aspects. The results are used to improve the awareness and training programme.
Supplementary Information - About the Criteria-
Disciplinary measures In the event of violations of policies and instructions or applicable legal and regulatory requirements, actions are taken in accordance with a defined policy that includes the following aspects:
• Verifying whether a violation has occurred; and
• Consideration of the nature and severity of the violation and its impact.
The internal and external employees of the Cloud Service Provider are informed about possible disciplinary measures.
The use of disciplinary measures is appropriately documented.
Additonal Criteria-
Supplementary Information - About the CriteriaThe Cloud Service Provider ensures that the policies and instructions reflect applicable legal and regulatory requirements in accordance with SP-01.
Responsibilities in the event of termination or change of employment Internal and external employees have been informed about which responsibilities, arising from employment terms and conditions relating to information security, will remain in place when their employment is terminated or changed and for how long.
Additonal Criteria-
Supplementary Information - About the CriteriaThe Cloud Service Provider ensures that the policies and instructions reflect applicable legal and regulatory requirements in accordance with SP-01.
Confidentiality agreements The non-disclosure or confidentiality agreements to be agreed with internal employees, external service providers and suppliers of the Cloud Service Provider are based on the requirements identified by the Cloud Service Provider for the protection of confidential information and operational details.
The agreements are to be accepted by external service providers and suppliers when the contract is agreed. The agreements must be accepted by internal employees of the Cloud Service Provider before authorisation to access data of cloud customers is granted.
The requirements must be documented and reviewed at regular intervals (at least annually). If the review shows that the requirements need to be adapted, the non-disclosure or confidentiality agreements are updated.
The Cloud Service Provider must inform the internal employees, external service providers and suppliers and obtain confirmation of the updated confidentiality or non-disclosure agreement.
Additonal Criteria-
Supplementary Information - About the CriteriaIn a confidentiality agreement it should be described:
• Which information must be kept confidential;
• The period for which this confidentiality agreement applies;
• What actions must be taken upon termination of this agreement, e.g. destruction or return of data medium;
• How the ownership of information is regulated;
• What rules apply to the use and disclosure of confidential information to other partners, if necessary; and
• The consequences of a breach of the agreement.
Confidentiality or non-disclosure agreements can be signed by means of an electronic signature, insofar as this is legally binding.

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos