SSO-07 Ensuring Transparency within Service Organisations

The cloud service provider designs, implements and maintains controls to ensure transparency within its service organisations with respect to the following aspects:

1. Data flow and interfaces between the cloud service provider and service organisations used by the cloud service provider are documented, including measures regarding the secure transmission and access control for data shared with service organisations; and

2. Cloud service customers are informed of service organisations used by the cloud service provider for development and operation of the cloud service and what type of data these service organisations and their subcontractors are processing.

Cloud service customers are informed which of the service organisations themselves use subcontractors to process cloud service customer data.

Supplementary information

This criterion addresses the need for managing supply chain risks (e.g. service organisation vulnerabilities, data handling practices, compliance gaps or operational disruptions) and for those risks to be communicated to cloud service customers, enabling them to monitor and manage their own supply chain risks effectively.

The cloud service provider documents this information and reviews its completeness, accuracy and validity at least annually.

The cloud service provider designs, implements and maintains controls to ensure transparency within its service organisations with respect to the following aspects:

1. Data flow and interfaces between the cloud service provider and service organisations used by the cloud service provider are documented, including measures regarding the secure transmission and access control for data shared with service organisations; and

2. Cloud service customers are informed of service organisations and their subcontractors used by the cloud service provider for development and operation of the cloud service and what type of data these service organisations and their subcontractors are processing.

Cloud service customers are informed which of the service organisations themselves use subcontractors to process cloud service customer data.