+Security Policies and Instructions (SP)
---+Documentation, communication and provision of policies and instructions
---+Review and Approval of Policies and Instructions
---+Exceptions from Existing Policies and Instructions
|
Security Policies and Instructions (SP)
None
1. Pregled
| Naslov |
Standard |
|
Documentation, communication and provision of policies and instructions
|
Policies and instructions (incl. concepts and guidelines) are derived from the information security policy and are documented according to a uniform structure. They are communicated and made available to all internal and external employees of the Cloud Service Provider in an appropriate manner.
The policies and instructions are version controlled and approved by the top management of the Cloud Service Provider or an authorised body.
The policies and instructions describe at least the following aspects:
• Objectives;
• Scope;
• Roles and responsibilities, including staff qualification requirements and the establishment of substitution rules;
• Roles and dependencies on other organisations (especially cloud customers and subservice organisations);
• Steps for the execution of the security strategy; and
• Applicable legal and regulatory requirements.
Additonal Criteria-
Supplementary Information - About the CriteriaThe appropriateness of the demand-oriented communication and provision must be assessed against the size and complexity of the Cloud Service Provider's organisation and the type of cloud service offered. Possible criteria are:
• Integration of guidelines and instructions in the onboarding of new employees
• Training and information campaigns when adopting new or revising existing policies and instructions
• Form of provision
Policies and instructions are required for the following basic criteria in which the content is specified in more detail:
• Risk management policy (OIS-06)
• Acceptable use and handling of assets policy (AM-02)
• Security requirements for premises and buildings (PS-01)
• Physical site access control (PS-04)
• Concept for protection against malware (OPS-04)
• Concept for data protection and recovery (OPS-06)
• Concept for logging and monitoring (OPS-10)
• Concept for meta data handling (OPS-11)
• Concept for handling of vulnerabilities, malfunctions and errors (OPS-18)
• Policy for system and data access authorisations (IDM-01)
• Policy for the use of encryption procedures and key management (CRY-01)
• Policies for data transmission (COS-08)
• Policies for the development/procurement of information systems (DEV-01)
• Policies for changes to information systems (DEV-03)
• Policies and instructions for controlling and monitoring third parties (SSO-01)
• Policy for security incident management (SIM-01)
• Business impact analysis policies and procedures (BCM-02)
• Policy for planning and conducting audits (COM-02)
|
|
Review and Approval of Policies and Instructions
|
Information security policies and instructions are reviewed at least annually for adequacy by the Cloud Service Provider's subject matter experts.
The review shall consider at least the following aspects:
• Organisational and technical changes in the procedures for providing the cloud service; and
• Legal and regulatory changes in the Cloud Service Provider's environment.
Revised policies and instructions are approved before they become effective.
Additonal Criteria-
Supplementary Information - About the Criteria-
|
|
Exceptions from Existing Policies and Instructions
|
Exceptions to the policies and instructions for information security as well as respective controls go through the OIS-06 risk management process, including approval of these exceptions and acceptance of the associated risks by the risk owners. The approvals of exceptions are documented, limited in time and are reviewed for appropriateness at least annually by the risk owners.
Additonal Criteria-
Supplementary Information - About the CriteriaAbout the CriterionExceptions in the sense of the basic criterion can have organisational or technical causes, such as
• An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud customer; and
• A system component lacks technical properties to configure it according to the applicable requirements.
Cloud customers can use appropriate controls to ensure that they obtain information from the Cloud Service Provider about deviations from information security policies and instructions in order to assess and appropriately manage the associated risks to their own information security.
|
1.1 Sklici
1.2 Ugotovljene zahteve
1.3 Povezani predpisi
2. Ugotovljene zahteve
3. Povezani predpisi
|