Cloud Computing Compliance Criteria Catalogue C5

Basic

Organisation of Information Security (OIS)

OIS-01 Information Security Management System (ISMS)

The basic criterion can also be fulfilled without valid certification of the ISMS according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz, if the submitted documentation meets the requirements of ISO/IEC 27001. The auditor has to evaluate whether the documentation meets the referenced requirements of the ISO standard. This does not require a full certification audit of the management system in accordance with ISO 17021, but a focused inspection of the related documentation. Cross-sectional functions do not need to be integrated into a single ISMS. Instead, multiple ISMS can be established to cover both service-related internal control systems and central functions effectively. The scope of the ISMS may go beyond the scope of the cloud service provider's system of internal control for the cloud service in scope of an assurance engagement with this criteria catalogue. If the scope of the ISMS is broader than the scope of the assurance engagement, evidence to be obtained about the design and operation of the ISMS can be limited to records that are applicable to the cloud service in scope of the assurance engagement.

Basic

Organisation of Information Security (OIS)

OIS-01 Information Security Management System (ISMS)

Basic

Organisation of Information Security (OIS)

OIS-01 Information Security Management System (ISMS)

Additional (Complementing)

Organisation of Information Security (OIS)

OIS-01 Information Security Management System (ISMS)

Basic

Organisation of Information Security (OIS)

OIS-02 Information Security Policy

The top management is a natural person or group of persons who make the final decision for the institution and is responsible for that decision.

Basic

Organisation of Information Security (OIS)

OIS-02 Information Security Policy

The top management is a natural person or group of persons who make the final decision for the institution and is responsible for that decision.

Basic

Organisation of Information Security (OIS)

OIS-02 Information Security Policy

Basic

Organisation of Information Security (OIS)

OIS-02 Information Security Policy

Basic

Organisation of Information Security (OIS)

OIS-03 Interfaces and Dependencies

Third parties in the sense of this basic criterion are, e.g. cloud service customers and subservice providers. The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.

Cloud service customers ensure through suitable controls that the guidelines and requirements for compliance with the contractual agreements with the cloud service provider (i.e., responsibilities, cooperation obligations and interfaces for reporting security incidents) are adequately defined, documented and set up.

Basic

Organisation of Information Security (OIS)

OIS-03 Interfaces and Dependencies

The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.

Basic

Organisation of Information Security (OIS)

OIS-03 Interfaces and Dependencies

The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.

Basic

Organisation of Information Security (OIS)

OIS-03 Interfaces and Dependencies

The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.

Basic

Organisation of Information Security (OIS)

OIS-03 Interfaces and Dependencies

Third parties in the sense of this basic criterion are, e.g. cloud service customers and subservice providers. The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.

Basic

Organisation of Information Security (OIS)

OIS-03 Interfaces and Dependencies

The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.

Basic

Organisation of Information Security (OIS)

OIS-04 Segregation of Duties

Identified events that may constitute unauthorised or unintentional changes to or misuse of cloud service customer data, cloud service derived data and cloud service provider data may, for example, be treated as a security incident, cf. SIM-01.

Basic

Organisation of Information Security (OIS)

OIS-04 Segregation of Duties

Basic

Organisation of Information Security (OIS)

OIS-04 Segregation of Duties

Basic

Organisation of Information Security (OIS)

OIS-04 Segregation of Duties

Additional (Complementing)

Organisation of Information Security (OIS)

OIS-04 Segregation of Duties

Additional (Complementing)

Organisation of Information Security (OIS)

OIS-04 Segregation of Duties

Basic

Organisation of Information Security (OIS)

OIS-05 Threat Intelligence

Basic

Organisation of Information Security (OIS)

OIS-05 Threat Intelligence

Basic

Organisation of Information Security (OIS)

OIS-05 Threat Intelligence

Basic

Organisation of Information Security (OIS)

OIS-06 Contact with Relevant Government Agencies and Interest Groups

Public sector organisations in Germany are e.g. ministries and authorities.

Basic

Organisation of Information Security (OIS)

OIS-07 Risk Management Policy

The risk level can be determined by qualitative, semi-quantitative and quantitative methods (cf. ISO 31010) based on the likelihood and impacts.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'. Shared resources are e.g. networks, RAM or storage. When determining protection needs of customer data, regulatory requirements applicable to customer data should be considered such as PCI-DSS, HIPAA, DORA (regulation on digital operational resilience for the financial sector and amending regulations), NIS 2 Directive and KRITIS.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Basic

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.

Additional (Complementing)

Organisation of Information Security (OIS)

OIS-08 Application of the Risk Management Policy

Basic

Organisation of Information Security (OIS)

OIS-09 Information Security in Project Management

Basic

Security Policies and Instructions (SP)

SP-01 Documentation, Communication and Provision of Policies and Instructions

Policies and instructions are required for the following basic criteria in which the content is specified in more detail: - Risk Management Policy (OIS-07);- Policy for Remote Working (HR-07);- Asset Management Concept (AM-01);- Acceptable Use and Safe Handling of Assets Policy (AM-05);- Policy for Removable Media and Endpoint Devices (AM-12);- Physical Security and Environmental Control Requirements (PS-01);- Physical Site Access Control (PS-04);- Workplace Security Requirements (PS-08);- Protection Against Malware - Concept (OPS-04);- Data Backup and Recovery - Concept (OPS-06);- Logging and Monitoring - Concept (OPS-10);- Logging and Monitoring - Metadata Management Concept (OPS-11);- Managing Vulnerabilities - Concept (OPS-18);- Managing Incidents and Crashes - Concept (OPS-19);- Separation of Datasets - Guideline (OPS-28);- Confidential Computing - Policies and Instructions (OPS-30);- Guideline for Container Management (OPS-32);- Managing Vulnerabilities - Patch Management (OPS-33);- Policy for User Accounts and Access Rights (IAM-01);- Authentication Mechanisms (authentication policy) (IAM-09);- Policy for the Use of Cryptographic Mechanisms (CRY-01);- Technical Safeguards (COS-01);- Policies for Data Transmission (COS-08);- Policies for Changes to System Components (DEV-03);- Development Service Organisations Security (policies and instructions for the use of third party and open source software) (DEV-14);- Policies and Instructions for Controlling and Monitoring Service Organisations (SSO-01);- Controlling Exchanges with Suppliers of Functional Components (SSO-08);- Policy for Security Incident Management (SIM-01);- Business Continuity and Emergency Management System (BCM-01);- Policy for Business Continuity Management (BCM-05);- Policy for Planning and Conducting Audits (COM-02); and- Communication of Technical Procedures for Data Disclosure in Investigation Requests (INQ-05).

Basic

Security Policies and Instructions (SP)

SP-01 Documentation, Communication and Provision of Policies and Instructions

The appropriateness of the demand-oriented communication and provision should be assessed against the size and complexity of the cloud service provider's organisation and the type of cloud service offered. Possible criteria are: - Integration of guidelines and instructions in the onboarding of new employees;- Training and information campaigns when adopting new or revising existing policies and instructions; and- Form of provision.

Basic

Security Policies and Instructions (SP)

SP-01 Documentation, Communication and Provision of Policies and Instructions

Basic

Security Policies and Instructions (SP)

SP-01 Documentation, Communication and Provision of Policies and Instructions

Basic

Security Policies and Instructions (SP)

SP-01 Documentation, Communication and Provision of Policies and Instructions

Basic

Security Policies and Instructions (SP)

SP-02 Review and Approval of Policies and Instructions

Basic

Security Policies and Instructions (SP)

SP-02 Review and Approval of Policies and Instructions

Basic

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Cloud service customers ensure through suitable controls that they obtain information from the cloud service provider about deviations from information security policies and instructions in order to assess and appropriately manage the associated risks to their own information security.

Basic

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Basic

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Basic

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Basic

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Basic

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Additional (Complementing)

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Additional (Complementing)

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Additional (Complementing)

Security Policies and Instructions (SP)

SP-03 Exceptions from Existing Policies and Instructions

Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.

Basic

Personnel (HR)

HR-01 Verification of Qualification and Trustworthiness

Basic

Personnel (HR)

HR-01 Verification of Qualification and Trustworthiness

External employees in the sense of the criteria are those who perform activities in accordance with the processes and procedures of the cloud service provider. Employees of service organisations who perform activities according to the service organisation's own processes and procedures are not covered by this criterion. Permissible verifications of competency and integrity may vary based on local law as well as the role of the employee. Depending on these factors and the nature of the checks conducted, explicit consent by the employee may be necessary. The verification of qualification and trustworthiness can be supported by specialised service providers or be based on voluntary self-disclosure of the employee. Depending on national legislation, national equivalents of the German certificate of good conduct ('Führungszeugnis') may also be permitted. Assessing the vulnerability of a potential employee to blackmail can involve evaluating their creditworthiness. However, this assessment may only be legally permissible for positions with significant financial responsibility, depending on local regulations. Risks related to inappropriate access to cloud service customer data may be mitigated by the use of encryption or monitoring system access for suspicious events. Although such measures are not supposed to completely substitute the above-mentioned verification measures, the extent of such measures may be reduced.

Basic

Personnel (HR)

HR-01 Verification of Qualification and Trustworthiness

Basic

Personnel (HR)

HR-01 Verification of Qualification and Trustworthiness

Basic

Personnel (HR)

HR-01 Verification of Qualification and Trustworthiness

Additional (Complementing)

Personnel (HR)

HR-01 Verification of Qualification and Trustworthiness

Basic

Personnel (HR)

HR-02 Employment Terms and Conditions

Basic

Personnel (HR)

HR-02 Employment Terms and Conditions

Basic

Personnel (HR)

HR-02 Employment Terms and Conditions

Basic

Personnel (HR)

HR-02 Employment Terms and Conditions

Basic

Personnel (HR)

HR-03 Security Training and Awareness Programme

Basic

Personnel (HR)

HR-03 Security Training and Awareness Programme

Basic

Personnel (HR)

HR-03 Security Training and Awareness Programme

Additional (Complementing)

Personnel (HR)

HR-03 Security Training and Awareness Programme

Additional (Complementing)

Personnel (HR)

HR-03 Security Training and Awareness Programme

Additional (Complementing)

Personnel (HR)

HR-03 Security Training and Awareness Programme

The measurement and evaluation of learning outcomes in a target group-oriented manner, as specified by the additional criterion, do not require assessing each employee individually. Instead, evaluations can be performed at an aggregated level, focusing on the overall effectiveness of the training program for specific target groups. This approach allows for the identification of trends and areas for improvement within the program while respecting employees' privacy requirements.

Additional (Complementing)

Personnel (HR)

HR-03 Security Training and Awareness Programme

Additional (Complementing)

Personnel (HR)

HR-03 Security Training and Awareness Programme

Basic

Personnel (HR)

HR-04 Disciplinary Measures

Basic

Personnel (HR)

HR-04 Disciplinary Measures

The cloud service provider ensures that the policies and instructions reflect applicable legal and regulatory requirements in accordance with SP-01.

Basic

Personnel (HR)

HR-04 Disciplinary Measures

Basic

Personnel (HR)

HR-04 Disciplinary Measures

With regards to the use of disciplinary measures, the submission of anonymised evidence is acceptable and does not imply that the basic criterion is not fully fulfilled.

Additional (Complementing)

Personnel (HR)

HR-04 Disciplinary Measures

Basic

Personnel (HR)

HR-05 Responsibilities in the Event of Termination or Change of Employment

The cloud service provider ensures that the employment terms and conditions reflect applicable legal and regulatory requirements in accordance with SP-01.

Basic

Personnel (HR)

HR-05 Responsibilities in the Event of Termination or Change of Employment

Basic

Personnel (HR)

HR-06 Non-disclosure Agreements

A non-disclosure agreement should cover: - Which information or data types must be kept confidential;- The period for which this confidentiality agreement applies;- What actions must be taken upon termination of this agreement, e.g. destruction or return of data medium;- How the ownership of information is regulated;- What rules apply to the use and disclosure of confidential information to other partners, if necessary; and- The consequences of a breach of the agreement.

Basic

Personnel (HR)

HR-06 Non-disclosure Agreements

Confidentiality or non-disclosure agreements should be signed by means of an electronic signature, insofar as this is legally binding.

Basic

Personnel (HR)

HR-06 Non-disclosure Agreements

Confidentiality or non-disclosure agreements should be signed by means of an electronic signature, insofar as this is legally binding.

Basic

Personnel (HR)

HR-06 Non-disclosure Agreements

Basic

Personnel (HR)

HR-06 Non-disclosure Agreements

Confidentiality or non-disclosure agreements should be signed by means of an electronic signature, insofar as this is legally binding.

Basic

Personnel (HR)

HR-06 Non-disclosure Agreements

Basic

Personnel (HR)

HR-07 Policy for Remote Working

Basic

Asset Management (AM)

AM-01 Asset Management Concept

Assets within the meaning of this domain are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These objects consist of hardware and software objects. Hardware objects are: - Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and- End user devices if the cloud service provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication). Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs). The lifecycle of an asset includes, depending on the asset type: - Acquisition;- Commissioning;- Maintenance;- Decommissioning; and- Disposal.

Additional (Complementing)

Asset Management (AM)

AM-01 Asset Management Concept

Assets within the meaning of this domain are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These objects consist of hardware and software objects. Hardware objects are: - Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and- End user devices if the cloud service provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication). Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs). The lifecycle of an asset includes, depending on the asset type: - Acquisition;- Commissioning;- Maintenance;- Decommissioning; and- Disposal.

Additional (Complementing)

Asset Management (AM)

AM-01 Asset Management Concept

Assets within the meaning of this domain are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These objects consist of hardware and software objects. Hardware objects are: - Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and- End user devices if the cloud service provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication). Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs). The lifecycle of an asset includes, depending on the asset type: - Acquisition;- Commissioning;- Maintenance;- Decommissioning; and- Disposal.

Basic

Asset Management (AM)

AM-02 Asset Inventory

Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.

Basic

Asset Management (AM)

AM-02 Asset Inventory

Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.

Basic

Asset Management (AM)

AM-02 Asset Inventory

Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.

Basic

Asset Management (AM)

AM-02 Asset Inventory

Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.

Basic

Asset Management (AM)

AM-02 Asset Inventory

Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.

Basic

Asset Management (AM)

AM-03 Hardware Asset Inventory

An 'Asset Owner' is an individual or role assigned with the responsibility and accountability for managing and protecting an organisation's asset and does not imply legal ownership of the assets. If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider should inventory the containers and document their life cycle (cf. OPS-32)

Basic

Asset Management (AM)

AM-04 Software Asset Inventory

Basic

Asset Management (AM)

AM-05 Policy for the proper and secure use of assets

Basic

Asset Management (AM)

AM-05 Policy for the proper and secure use of assets

Basic

Asset Management (AM)

AM-06 Commissioning of Hardware

The criterion applies only to physical hardware objects, such as servers, storage systems, and network components. Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV). The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.

Basic

Asset Management (AM)

AM-06 Commissioning of Hardware

The criterion applies only to physical hardware objects, such as servers, storage systems, and network components. Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV). The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.

Basic

Asset Management (AM)

AM-07 Decommissioning of Hardware

Basic

Asset Management (AM)

AM-07 Decommissioning of Hardware

The deletion of data or physical destruction of data mediums can take place, for example, according to DIN 66399 or BSI IT-Grundschutz module CON.6.

Additional (Complementing)

Asset Management (AM)

AM-07 Decommissioning of Hardware

Additional (Complementing)

Asset Management (AM)

AM-07 Decommissioning of Hardware

The deletion of data or physical destruction of data mediums can take place, for example, according to DIN 66399 or BSI IT-Grundschutz module CON.6.

Basic

Asset Management (AM)

AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets

The criterion essentially concerns mobile devices (e.g. notebooks, tablets, smartphones, etc.), especially if confidential information is stored on them that can be used, in the event of unauthorised access, to obtain privileged access to the cloud service (e.g. if these are used as security tokens for authentication).

Basic

Asset Management (AM)

AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets

The criterion essentially concerns mobile devices (e.g. notebooks, tablets, smartphones, etc.), especially if confidential information is stored on them that can be used, in the event of unauthorised access, to obtain privileged access to the cloud service (e.g. if these are used as security tokens for authentication).

Basic

Asset Management (AM)

AM-09 Asset Classification and Labelling

If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.

Cloud service customers ensure through suitable controls that the need for protection of the information that can be processed or stored with the cloud service is adequately determined. Cloud service customers ensure through suitable controls that the information processed or stored with the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with its protection needs.

Basic

Asset Management (AM)

AM-09 Asset Classification and Labelling

If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.

Basic

Asset Management (AM)

AM-09 Asset Classification and Labelling

If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.

Basic

Asset Management (AM)

AM-09 Asset Classification and Labelling

If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.

Additional (Complementing)

Asset Management (AM)

AM-09 Asset Classification and Labelling

To ensure that all physical assets are uniquely identified, the cloud service provider may implement practices such as: - Use of a centralised device management platform to monitor and control all devices;- Assigning unique identifiers (e.g. MAC addresses, serial numbers) to all devices; and- Use of automated mechanisms to register connecting devices.

Additional (Complementing)

Asset Management (AM)

AM-09 Asset Classification and Labelling

Additional (Complementing)

Asset Management (AM)

AM-09 Asset Classification and Labelling

Additional (Complementing)

Asset Management (AM)

AM-09 Asset Classification and Labelling

Basic

Asset Management (AM)

AM-10 Protection of Hardware on Hold

Basic

Asset Management (AM)

AM-11 Transfer of Hardware

Basic

Asset Management (AM)

AM-11 Transfer of Hardware

Basic

Asset Management (AM)

AM-11 Transfer of Hardware

Basic

Asset Management (AM)

AM-12 Policy for Removable Media and Endpoint Devices

Additional (Complementing)

Asset Management (AM)

AM-12 Policy for Removable Media and Endpoint Devices

Basic

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Basic

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Basic

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. The recognised established rules of technology are defined in relevant standards, e.g. EN 50600 (facilities and infrastructures of data centres). Note for German readers: The German version of C5 uses the term Stand der Technik for established rules of technology although the German reader might expect the term state of the art. Without discussing the semantic, please note that state of the art defines a higher level than Stand der Technik and therefore established rules of technology is used here.

Basic

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Basic

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. Premises and buildings operated by third parties are e.g. server housing, colocation, IaaS.

Basic

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Additional (Complementing)

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. Time specifications for self-sustaining operation as well as maximum tolerable downtimes of utility facilities are typically collected during the business impact analysis (cf. BCM-02, BCM-03).

Additional (Complementing)

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. The 72-hour timeframe for self-sufficient operation aligns with guidelines for government agencies, businesses and critical infrastructure operators (KRITIS) as per the Federal Office for Civil Protection and Disaster Assistance (BBK).

Additional (Complementing)

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Additional (Complementing)

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Additional (Complementing)

Physical Security (PS)

PS-01 Physical Security and Environmental Control Requirements

Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.

Basic

Physical Security (PS)

PS-02 Redundancy Model

Operational redundancy of the sites to each other in the sense of this criterion is given if based on the assessment of elementary risks at the site corresponding distances of the premises and buildings to these risks are maintained. Very extensive events which, due to their extent, could affect several sites of the same redundancy group simultaneously or in a timely manner (e.g. floods, earthquakes) are not considered. There are cloud service providers who no longer address the issue of reliability of the cloud service on a physical level through redundancy from two independent locations, but through resilience. The cloud service is provided simultaneously from more than two locations. The underlying distributed data centre architecture ensures that the failure of a location or components of a location does not violate the defined availability criteria of the cloud service. Such an architecture can represent an alternative fulfilment (cf. Chapter 3.4.8) of the criterion. The tests and exercises on functionality required in the criterion also apply analogously to resilient architectures.

Cloud service customers ensure through suitable controls that the existing redundancy model of the cloud service provider and the evidence for the verification of the model comply with their own requirements for the availability and reliability of the cloud service.

Additional (Sharpening)

Physical Security (PS)

PS-02 Redundancy Model

A georedundancy of the sites to each other in the sense of this criterion is given if a very extensive event at a site under no circumstances affects several sites of the same redundancy group simultaneously or promptly. The BSI publication 'Kriterien für die Standortwahl von Rechenzentren' provides assistance in this regard.

Basic

Physical Security (PS)

PS-02 Redundancy Model

Operational redundancy of the sites to each other in the sense of this criterion is given if based on the assessment of elementary risks at the site corresponding distances of the premises and buildings to these risks are maintained. Very extensive events which, due to their extent, could affect several sites of the same redundancy group simultaneously or in a timely manner (e.g. floods, earthquakes) are not considered. There are cloud service providers who no longer address the issue of reliability of the cloud service on a physical level through redundancy from two independent locations, but through resilience. The cloud service is provided simultaneously from more than two locations. The underlying distributed data centre architecture ensures that the failure of a location or components of a location does not violate the defined availability criteria of the cloud service. Such an architecture can represent an alternative fulfilment (cf. Chapter 3.4.8) of the criterion. The tests and exercises on functionality required in the criterion also apply analogously to resilient architectures.

Additional (Sharpening)

Physical Security (PS)

PS-02 Redundancy Model

A georedundancy of the sites to each other in the sense of this criterion is given if a very extensive event at a site under no circumstances affects several sites of the same redundancy group simultaneously or promptly. The BSI publication 'Kriterien für die Standortwahl von Rechenzentren' provides assistance in this regard.

Basic

Physical Security (PS)

PS-02 Redundancy Model

Basic

Physical Security (PS)

PS-03 Perimeter Protection

Basic

Physical Security (PS)

PS-03 Perimeter Protection

Security measures for detecting unauthorised access can be security personnel, video surveillance or burglar alarm systems.

Basic

Physical Security (PS)

PS-03 Perimeter Protection

The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard.

Basic

Physical Security (PS)

PS-03 Perimeter Protection

The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard.

Basic

Physical Security (PS)

PS-03 Perimeter Protection

Compensating measures can include additional security layers (e.g. security areas) on the premise, an increased presence of security personnel, video surveillance and anti-burglary systems.

Basic

Physical Security (PS)

PS-03 Perimeter Protection

Additional (Complementing)

Physical Security (PS)

PS-03 Perimeter Protection

Basic

Physical Security (PS)

PS-04 Physical Site Access Control

For implementing access control based on the need-to-know-principle, a zoning concept can be deployed with each on-premises area having separate access permissions. If a zoning concept is implemented, each on-premises area should be physically separated with its own access control system. Examples for zoning on-premises can be: - Green zone: Public area, contains no resources that are relevant to the provisioning of the cloud service;- Yellow zone: Private area, contains means for supporting the cloud service such as development, administration and supervision; and- Red zone: Sensitive area for production systems such as the server rooms. Exceptions to the revocation of access authorisations after two months of inactivity are limited to cases where employees with specific roles, such as management positions or supervisors, require only occasional but crucial entry. For all other employees, the revocation of access rights takes place after two months as described in the criterion.

Basic

Physical Security (PS)

PS-04 Physical Site Access Control

Basic

Physical Security (PS)

PS-04 Physical Site Access Control

Basic

Physical Security (PS)

PS-05 Protection against Threats from Outside and from the Environment

Basic

Physical Security (PS)

PS-05 Fire Protection

Structural parts are walls, ceilings, floors, doors, windows and other breakthroughs like ventilation flaps, etc. Compensating measures can take into account aspects such as: - Partitioning and layout of fire sections;- Extinguishing systems within the fire sections;- Early and very early fire detection mechanisms;- Arrival time of the fire brigade after the fire alarm was triggered; and- Redundancy of systems and supply facilities within the premise. The location of all critical facilities in relation to the highest historically recorded flood level at the cloud data centre site or the site's backwater level acts as the starting point for considering flood and heavy rain protection measures.

Basic

Physical Security (PS)

PS-05 Fire Protection

The monitoring of the environmental parameters is addressed in PS-07. When exceeding the allowed control range, alarm messages are generated and forwarded to the responsible cloud service provider.

Basic

Physical Security (PS)

PS-05 Fire Protection

Basic

Physical Security (PS)

PS-06 Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities

Measures to prevent the failure of the technical supply facilities are e.g. power supply, cooling, fire-fighting technology, telecommunications, security technology, etc. Cloud service providers can ensure that all data remains undamaged in the event of a power failure by shutting down servers following a defined procedure. Power supply and telecommunications lines can be protected against interruption, interference, damage and eavesdropping by e.g. underground supply via different supply routes.

Basic

Physical Security (PS)

PS-06 Power Supply

Basic

Physical Security (PS)

PS-06 Power Supply

Basic

Physical Security (PS)

PS-06 Power Supply

Additional (Complementing)

Physical Security (PS)

PS-06 Power Supply

Additional (Complementing)

Physical Security (PS)

PS-06 Power Supply

Additional (Complementing)

Physical Security (PS)

PS-06 Power Supply

Additional (Complementing)

Physical Security (PS)

PS-06 Power Supply

Basic

Physical Security (PS)

PS-07 Surveillance of Operational and Environmental Parameters

Operating parameters and environmental parameters of the premises and buildings are, e.g. air temperature and humidity, leakage, smoke.

Basic

Physical Security (PS)

PS-07 Environmental Monitoring

Basic

Physical Security (PS)

PS-08 Workplace Security Requirements

Basic

Operations (OPS)

OPS-01 Capacity Management - Planning

For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit. Capacity bottlenecks are limitations in the cloud service provider’s resources, resulting in disruptions of the cloud service or impacting compliance with contractual agreements and service levels.

Cloud service customers ensure through suitable controls that the capacity and resource requirements to be covered by the cloud service provider are planned and reflected in the SLA with the cloud service provider. The requirements are reviewed regularly and the adjustment of SLA demanded accordingly.

Basic

Operations (OPS)

OPS-01 Operational Security

For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.

Basic

Operations (OPS)

OPS-01 Operational Security

For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.

Additional (Complementing)

Operations (OPS)

OPS-01 Operational Security

For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.

Basic

Operations (OPS)

OPS-02 Capacity Management - Monitoring

Technical and organisational measures typically include: - Use of monitoring tools with alarm function when defined threshold values are exceeded;- Process for correlating events and interface to incident management;- Continuous monitoring of the systems by qualified personnel; and- Redundancies in the IT systems.

Cloud service customers ensure through suitable controls that the contractual agreements made with the cloud service provider for the provision of resources or services can be monitored. In case of deviations, appropriate controls ensure that the cloud service provider is informed so that the cloud service provider can take appropriate action.

Basic

Operations (OPS)

OPS-02 Change Management

Additional (Complementing)

Operations (OPS)

OPS-02 Change Management

Basic

Operations (OPS)

OPS-03 Capacity Management - Controlling of Resources

Resources according to the possibilities of the service model are for example: - Computing capacity;- Storage capacity;- Configuration of network properties;- Application Programming Interfaces (APIs); and- Databases. System resource allocation may need to take into account any container-based infrastructure used in the service models.

Cloud service customers ensure through suitable controls that they manage and monitor the system resources in their area of responsibility.

Basic

Operations (OPS)

OPS-03 Capacity Management

Basic

Operations (OPS)

OPS-04 Protection Against Malware - Concept

Protection programmes for employee devices can be, for example, server-based protection programmes that scan files in attachments on the server or filter network traffic.

Basic

Operations (OPS)

OPS-05 Protection Against Malware - Implementation

Protection against malicious programmes can be implemented by operating system-specific protection mechanisms or explicit protection programmes (e.g. for signature- and behaviour-based detection and removal of malicious programmes). If the cloud provider operates malware protected containers or virtual machines to provide the cloud service, the malware protection should include container-specific measures. This can include, for example, monitoring the container images and the container runtime, and due to the frequent start and stop of the containers, real-time scans and -monitoring processes.

Cloud service customers ensure through suitable controls that the layers of the cloud service which they are responsible for have security products in place to detect and remove malware.

Basic

Operations (OPS)

OPS-05 Logging and Monitoring

Protection against malicious programmes can be implemented by operating system-specific protection mechanisms or explicit protection programmes (e.g. for signature- and behaviour-based detection and removal of malicious programmes). If the cloud provider operates malware protected containers or virtual machines to provide the cloud service, the malware protection should include container-specific measures. This can include, for example, monitoring the container images and the container runtime, and due to the frequent start and stop of the containers, real-time scans and -monitoring processes.

Additional (Sharpening)

Operations (OPS)

OPS-05 Logging and Monitoring

Protection against malicious programmes can be implemented by operating system-specific protection mechanisms or explicit protection programmes (e.g. for signature- and behaviour-based detection and removal of malicious programmes). If the cloud provider operates malware protected containers or virtual machines to provide the cloud service, the malware protection should include container-specific measures. This can include, for example, monitoring the container images and the container runtime, and due to the frequent start and stop of the containers, real-time scans and -monitoring processes.

Additional (Complementing)

Operations (OPS)

OPS-05 Logging and Monitoring

Additional (Complementing)

Operations (OPS)

OPS-05 Logging and Monitoring

Additional (Complementing)

Operations (OPS)

OPS-05 Logging and Monitoring

Additional (Complementing)

Operations (OPS)

OPS-05 Logging and Monitoring

Basic

Operations (OPS)

OPS-06 Data Backup and Recovery - Concept

If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.The data backup concept specifies which type of data backup is to be carried out (e.g. scope, frequency and duration) and specifies which data shall also be backed up in special cases (e.g. pure use of compute nodes without data storage). When backing up data, one has to distinct between backups and snapshots of virtual machines. Snapshots do not replace backups but can be part of the backup strategy to achieve Recovery Point Objectives (RPO) if they are additionally stored outside the original data location. The business requirements of the cloud service provider for the scope, frequency and duration of the data backup result from the business impact analysis (cf. BCM-02) for development and operational processes of the cloud service. If different data backup and recovery procedures exist for cloud service customer data and cloud service provider data, both variants should be in scope for tests of controls according to this criteria catalogue. Existing contractual agreements prior to a C5 attestation do not need to be updated to incorporate the requirements specified in this criterion. Instead, new contractual agreements should be designed to ensure that specified requirements are clearly defined and agreed upon with cloud service customers.

Cloud service customers ensure through suitable controls that the contractual agreements made with the cloud service provider regarding the scope, frequency and duration of data retention meet business requirements. The business requirements are assessed as part of the business impact analysis (cf. BCM-02).

Basic

Operations (OPS)

OPS-07 Data Backup and Recovery - Monitoring

If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.

Cloud service customers ensure through suitable controls that the backup of data within their area of responsibility is monitored by technical and organisational measures.

Basic

Operations (OPS)

OPS-07 Security Testing

If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.

Additional (Complementing)

Operations (OPS)

OPS-07 Security Testing

If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.

Basic

Operations (OPS)

OPS-08 Data Backup and Recovery - Regular Testing

The use of cloud service customer data in backup and restore procedures as described in the basic criterion is a carefully considered exception. This exception does not extend to general software development or other testing environments and the use of cloud service customer data for testing is restricted specifically to backup and restore procedures.

Cloud service customers ensure through suitable controls that they actively request information on the results of recovery tests from the cloud service provider. Customers assess the effectiveness of applied data recovery strategies and integrate insights into their own emergency plans in alignment with their business needs and security standards.

Basic

Operations (OPS)

OPS-08 Incident Response

Basic

Operations (OPS)

OPS-08 Incident Response

If cloud service customer data is restored in an environment with differing access restrictions, the confidentiality of the data may be affected.

Basic

Operations (OPS)

OPS-08 Incident Response

Basic

Operations (OPS)

OPS-08 Incident Response

Basic

Operations (OPS)

OPS-08 Incident Response

Additional (Complementing)

Operations (OPS)

OPS-08 Incident Response

Additional (Complementing)

Operations (OPS)

OPS-08 Incident Response

Basic

Operations (OPS)

OPS-09 Data Backup and Recovery - Storage

A remote location can be e.g. another data centre of the cloud service provider.

Basic

Operations (OPS)

OPS-09 Business Continuity

Basic

Operations (OPS)

OPS-09 Business Continuity

A remote location can be e.g. another data centre of the cloud service provider.

Basic

Operations (OPS)

OPS-09 Business Continuity

A remote location can be e.g. another data centre of the cloud service provider.

Basic

Operations (OPS)

OPS-09 Business Continuity

A remote location can be e.g. another data centre of the cloud service provider.

Basic

Operations (OPS)

OPS-09 Business Continuity

Basic

Operations (OPS)

OPS-10 Logging and Monitoring - Concept

Logs as referred to in the basic criterion include cloud service derived data and cloud service provider data.Legal and regulatory frameworks can define e.g. legal requirements for retention and deletion of data.

Cloud service customers ensure through suitable controls that appropriate logging and monitoring of events that may affect the security and availability of the cloud service (e.g. administrator activities, system failures, authentication checks, data deletions, etc.) takes place for those layers of the cloud service under their responsibility.

Basic

Operations (OPS)

OPS-11 Logging and Monitoring Management Concept for Cloud Service Derived Data and Account Data

Cloud service customers ensure through suitable controls that their contracts with the cloud service provider clearly outline the permissible uses of cloud service derived data. Cloud service customers verify that such data processing complies with contractual or legal restrictions and understand that the provider is obligated to delete data when it is no longer necessary for its initial purposes, unless agreed otherwise.

Basic

Operations (OPS)

OPS-11 Configuration Management

Additional (Complementing)

Operations (OPS)

OPS-11 Configuration Management

Additional (Complementing)

Operations (OPS)

OPS-11 Configuration Management

Basic

Operations (OPS)

OPS-12 Logging and Monitoring - Access, Storage and Deletion

Basic

Operations (OPS)

OPS-13 Security Information and Event Management

Basic

Operations (OPS)

OPS-13 Network Security

Basic

Operations (OPS)

OPS-13 Network Security

Additional (Complementing)

Operations (OPS)

OPS-13 Network Security

Additional (Complementing)

Operations (OPS)

OPS-13 Network Security

Additional (Complementing)

Operations (OPS)

OPS-13 Network Security

Basic

Operations (OPS)

OPS-14 Logging and Monitoring - Storage of the Logging Data

Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.

Cloud service customers ensure through suitable controls that they actively request the customer-specific portion of the cloud service derived data that consists of log data, if required.

Basic

Operations (OPS)

OPS-14 Data Protection

Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.

Basic

Operations (OPS)

OPS-14 Data Protection

Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.

Additional (Complementing)

Operations (OPS)

OPS-14 Data Protection

Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.

Basic

Operations (OPS)

OPS-15 Logging and Monitoring - Accountability

Cloud service customers ensure through suitable controls that unique user IDs are assigned which allow a corresponding analysis in the event of an incident.

Basic

Operations (OPS)

OPS-15 Access Control

Basic

Operations (OPS)

OPS-15 Access Control

Infrastructure components within the meaning of this criterion are e.g. fabric controllers, network components and virtualisation servers.

Additional (Complementing)

Operations (OPS)

OPS-15 Access Control

The additional criterion also refers to logs of system components under responsibility of the cloud service provider, to which the cloud service customer generally has no access, insofar as these logs are relevant for the analysis of security incidents and for identifying access to cloud service customer service data (cf. IAM-07 and INQ-04). For logging of system components under responsibility of the cloud service provider cf. PSS-04.

Additional (Complementing)

Operations (OPS)

OPS-15 Access Control

Basic

Operations (OPS)

OPS-16 Logging and Monitoring - Configuration

Basic

Operations (OPS)

OPS-16 Security Monitoring

Basic

Operations (OPS)

OPS-17 Logging and Monitoring - Availability of the Monitoring Software

Basic

Operations (OPS)

OPS-17 Security Operations

Additional (Complementing)

Operations (OPS)

OPS-17 Security Operations

Additional (Complementing)

Operations (OPS)

OPS-17 Security Operations