6.2.2.1
Secure Cloud and Outsourced IT Services
Evaluate Outsourced IT
Secure Cloud and Outsourced IT Services – Evaluate Outsourced IT – Organization using cloud applications and/or outsourcing IT services shall evaluate their risk tolerance level with how their outsourced IT providers handle and access their sensitive information.
-
5.14 Information Transfer: Establish information transfer rules, procedures, or agreements for all internal and external transfer facilities.
5.19 Information Security in Supplier Relationships: Define and implement processes and procedures to manage security risks associated with the use of the supplier products or services.
5.20 Addressing Information Security Within Supplier Agreements: Establish and agree on relevant security requirements with each supplier based on their relationship type.
5.21 Managing Information Security in the ICT Supply Chain: Define and implement procedures to manage security risks in the ICT supply chain.
5.22 Monitoring and Review and Change Management of Supplier Services: Regularly monitor, review, evaluate, and manage changes in supplier security practices and service delivery.
5.32 Intellectual Property Rights: Implement suitable procedures to safeguard intellectual property rights.
8.25 Secure Development Life Cycle: Establish and enforce rules for secure software and system development.
8.30 Outsourced Development: The organization should direct, monitor, and evaluate activities related to outsourced system development.
-
-