+Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests

Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests

The Cloud Service Provider has penetration tests carried out by qualified internal personnel or external service providers at least once a year. The penetration tests are carried out according to a documented test methodology and include the system components relevant to the provision of the cloud service in the area of responsibility of the Cloud Service Provider, which have been identified as such in a risk analysis.
The Cloud Service Provider assess the severity of the findings made in penetration tests according to defined criteria.
For findings with medium or high criticality regarding the confidentiality, integrity or availability of the cloud service, actions must be taken within defined time windows for prompt remediation or mitigation.
Additonal CriteriaThe tests are carried out every six months. They must always be performed by independent external auditors. Internal personnel for penetration tests may support the external service providers.
Supplementary Information - About the CriteriaVulnerabilities should be classified according to damage potential and a period of time should be specified for the required response. The following classification according to the BSI publication "Ein PraxisLeitfaden für ISPenetrationstests" can serve as an orientation:
• High: Immediate reaction;
• Medium: Short-term response;
• Low: Medium-term response; and
• Information: Long-term response.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve

3. Povezani predpisi

Predpisi