+BSI C5
---+Product Safety and Security (PSS)
------+Guidelines and Recommendations for Cloud Customers
------+Identification of Vulnerabilities of the Cloud Service
------+Online Register of Known Vulnerabilities
------+Error handling and Logging Mechanisms
------+Authentication Mechanisms
------+Session Management
------+Confidentiality of Authentication Information
------+Roles and Rights Concept
------+Authorisation Mechanisms
------+Software Defined Networking
------+Images for Virtual Machines and Containers
------+Locations of Data Processing and Storage
---+Business Continuity Management (BCM)
------+Top management responsibility
------+Business impact analysis policies and instructions
------+Planning business continuity
------+Verification, updating and testing of the business continuity
---+Security Incident Management (SIM)
------+Processing of security incidents
------+Documentation and reporting of security incidents
------+Duty of the users to report security incidents to a central body
------+Evaluation and learning process
------+Policy for security incident management
---+Dealing with investigation requests from government agencies (INQ)
------+Legal Assessment of Investigative Inquiries
------+Informing Cloud Customers about Investigation Requests
------+Conditions for Access to or Disclosure of Data in Investigation Requests
------+Limiting Access to or Disclosure of Data in Investigation Requests
---+Compliance (COM)
------+Identification of applicable legal, regulatory, self-imposed or contractual requirements
------+Policy for planning and conducting audits
------+Internal audits of the information security management system
------+Information on information security performance and management assessment of the ISMS
---+Portability and Interoperability (PI)
------+Documentation and safety of input and output interfaces
------+Contractual agreements for the provision of data
------+Secure deletion of data
---+Procurement, Development and Modification of Information Systems (DEV)
------+Policies for the development/procurement of information systems
------+Outsourcing of the development
------+Policies for changes to information systems
------+Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools.
------+Risk assessment, categorisation and prioritisation of changes
------+Testing changes
------+Logging of changes
------+Version Control
------+Approvals for provision in the production environment
------+Separation of environments
---+Communication Security (COS)
------+Technical safeguards
------+Security requirements for connections in the Cloud Service Provider's network
------+Monitoring of connections in the Cloud Service Provider's network
------+Cross-network access
------+Networks for administration
------+Segregation of data traffic in jointly used network environments
------+Documentation of the network topology
------+Policies for data transmission
---+Control and Monitoring of Service Providers and Suppliers (SSO)
------+Policies and instructions for controlling and monitoring third parties
------+Risk assessment of service providers and suppliers
------+Directory of service providers and suppliers
------+Monitoring of compliance with requirements
------+Exit strategy for the receipt of benefits
---+Personnel (HR)
------+Verification of qualification and trustworthiness
------+Employment terms and conditions
------+Security training and awareness programme
------+Disciplinary measures
------+Responsibilities in the event of termination or change of employment
------+Confidentiality agreements
---+Physical Security (PS)
------+Physical Security and Environmental Control Requirements
------+Redundancy model
------+Perimeter Protection
------+Physical site access control
------+Protection from fire and smoke
------+Protection against interruptions caused by power failures and other such risks
------+Surveillance of operational and environmental parameters
---+Organisation of Information Security (OIS)
------+Segregation of Duties
------+Contact with Relevant Government Agencies and Interest Groups
------+Risk Management Policy
------+Application of the Risk Management Policy
------+Information Security Management System (ISMS)
------+Information Security Policy
------+Interfaces and Dependencies
---+Security Policies and Instructions (SP)
------+Documentation, communication and provision of policies and instructions
------+Review and Approval of Policies and Instructions
------+Exceptions from Existing Policies and Instructions
---+Cryptography and Key Management (CRY)
------+Policy for the use of encryption procedures and key management
------+Encryption of data for transmission (transport encryption)
------+Encryption of sensitive data for storage
------+Secure key management
---+Asset Management (AM)
------+Asset Inventory
------+Acceptable Use and Safe Handling of Assets Policy
------+Commissioning of Hardware
------+Decommissioning of Hardware
------+Commitment to Permissible Use, Safe Handling and Return of Assets
------+Asset Classification and Labelling
---+Identity and Access Management (IDM)
------+Policy for user accounts and access rights
------+Granting and change of user accounts and access rights
------+Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins
------+Withdraw or adjust access rights as the task area changes
------+Regular review of access rights
------+Privileged access rights
------+Access to cloud customer data
------+Confidentiality of authentication information
------+Authentication mechanisms
---+Operations (OPS)
------+Capacity Management - Planning
------+Capacity Management - Monitoring
------+Capacity Management - Controlling of Resources
------+Protection Against Malware - Concept
------+Protection Against Malware - Implementation
------+Data Protection and Recovery - Concept
------+Data Backup and Recovery - Monitoring
------+Data Backup and Recovery - Regular Testing
------+Data Backup and Recovery - Storage
------+Logging and Monitoring - Concept
------+Logging and Monitoring - Metadata Management Concept
------+Logging and Monitoring - Access, Storage and Deletion
------+Logging and Monitoring - Identification of Events
------+Logging and Monitoring - Storage of the Logging Data
------+Logging and Monitoring - Accountability
------+Logging and Monitoring - Configuration
------+Logging and Monitoring - Availability of the Monitoring Software
------+Managing Vulnerabilities, Malfunctions and Errors - Concept
------+Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests
------+Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures
------+Involvement of Cloud customers in the event of incidents
------+Testing and Documentation of known Vulnerabilities
------+Managing Vulnerabilities, Malfunctions and Errors - System Hardening
------+Separation of Datasets in the Cloud Infrastructure
---+General Conditions
------+Information on jurisdiction and locations
------+Information on availability and incident handling during regular operation
------+Information on recovery parameters in emergency operation
------+Information on the availability of the data centre
------+Information on how investigation enquiries from government authorities are handled
------+Information on certifications or attestations
|
BSI C5
None
1. Prehľad
1.1 Odkazy
1.2 Identifikované požiadavky
1.3 Súvisiace predpisy
2. Identifikované požiadavky
Požiadavky
| Zdroj |
Požiadavka |
3. Súvisiace predpisy
Prepojené úlohy
|