+Internal audits of the information security management system

Internal audits of the information security management system

Subject matter experts check the compliance of the information security management system at regular intervals, at least annually, with the relevant and applicable legal, regulatory, selfimposed or contractual requirements (cf. COM01) as well as compliance with the policies and instructions (cf. SP01) within their scope of responsibility (cf. OIS01) through internal audits (cf. § 9.2 of ISO/IEC 27001).
Identified vulnerabilities and deviations are subject to risk assessment in accordance with the risk management procedure (cf. OIS06) and followup measures are defined and tracked (cf. OPS-18).
Additonal CriteriaInternal audits are supplemented by procedures to automatically monitor applicable requirements of policies and instructions with regard to the following aspects:
• Configuration of system components to provide the cloud service within the Cloud Service Provider's area of responsibility;
• Performance and availability of these system components;
• Response time to malfunctions and security incidents;
• Recovery time (time to completion of error handling);
Identified vulnerabilities and deviations are automatically reported to the appropriate Cloud Service Provider’s subject matter experts for immediate assessment and action.
Cloud customers can view compliance with selected contractual requirements in real time.
Supplementary Information - About the CriteriaSubject matter experts operate, e.g., in the Cloud Service Provider's internal revision department or expert third parties commissioned by the Cloud Service Provider, such as auditing companies, and may hold relevant certifications such as "Certified Internal Auditor (CIA)".
With regard to ISMS compliance, see Section 9.2 of ISO/IEC 27001.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve

3. Povezani predpisi

Predpisi