PSS-02 Identification of Vulnerabilities of the Cloud Service

The cloud service provider applies appropriate measures to check the cloud service for vulnerabilities which might have been integrated into the cloud service during the software development process.

Supplementary information

Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Incidents and Errors - Vulnerability Scans).

The procedures for identifying such vulnerabilities are part of the software development process and, depending on a risk assessment, include the following activities:

1. Static Application Security Testing;

2. Dynamic Application Security Testing;

3. Code reviews by the cloud service provider's subject matter experts;

4. Conducting security checks based on a list of software components or Software Bill of Materials (SBOM); and

5. Obtaining information about confirmed vulnerabilities in software libraries provided by third parties and used in their own cloud service.

Supplementary information

Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Incidents and Errors - Vulnerability Scans).

The severity of identified vulnerabilities is assessed according to defined criteria and measures are taken to immediately eliminate or mitigate them.

Supplementary information

Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Incidents and Errors - Vulnerability Scans).

The procedures for identifying such vulnerabilities also include annual code reviews or security penetration tests by qualified external third parties.

Supplementary information

Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Incidents and Errors - Vulnerability Scans).