AM-11 Transfer of Hardware

Based on a risk assessment (cf. OIS-07), the cloud service provider ensures the secure and controlled transfer of hardware objects used in the cloud service production environment to an offsite or alternate location.

The transfer of hardware is authorised by designated personnel.

Supplementary information

Authorisation ensures that hardware object transfers, whether internal or external, are controlled, traceable, and compliant with organisational policies. This is particularly important for assets containing sensitive data or used in production environments. The process typically includes:

1. Verification of asset ownership and classification;

2. Assessment of associated risks;

3. Documentation of the transfer request and approval; and

4. Confirmation of secure handling during transit.

The cloud service provider ensures that all transfers of hardware objects used in the cloud service production environment are conducted using secure, documented methods designed to prevent unauthorised access, tampering, data leakage, or loss during transit. These methods include physical protection, chain-of-custody tracking, and verification upon receipt.