6.2.3.1
Secure Cloud and Outsourced IT Services
Cloud and IT Outsourcing Compliance
Secure Cloud and Outsourced IT Services – Cloud and IT Outsourcing Compliance -The organization using cloud applications and/or outsourcing IT services shall:
a. Complete a risk assessment of externally provided services.
b. Require that all their external providers share a report that states that they achieved compliance with SOC 2, ISO/IEC 27001, PCI-DSS, ISO/IEC 20000, CAN/DGSI 104:2021 or equivalent, or provide a documented business case as why they chose not to;
NOTE: The organization determines equivalence to the standard depending on the type of IT service that is outsourced.
c. Complete a risk assessment of their data transmittal and data storage process (e.g., risks associated with legal jurisdictions);
d. Ensure that their IT infrastructure and users communicate securely with all cloud services and applications; and
e. Ensure that all administrative accounts for cloud services use multi-factor authentication and differ from internal administrator accounts.
-
5.14 Information Transfer: Establish information transfer rules, procedures, or agreements for all internal and external transfer facilities.
5.15 Access Control: Establish and implement access control rules for physical and logical access to the information based on business and security needs.
5.23 Information Security for Use of Cloud Services: Establish processes for acquiring, using, managing, and exiting cloud services aligned with information security requirements.
5.31 Legal, Statutory, Regulatory and Contractual Requirements: Identify, document, and update legal, statutory, regulatory, and contractual requirements relevant to information security and the organization’s compliance approach.
5.32 Intellectual Property Rights: Implement suitable procedures to safeguard intellectual property rights.
8.25 Secure Development Life Cycle: Establish and enforce rules for secure software and system development.
8.30 Outsourced Development: The organization should direct, monitor, and evaluate activities related to outsourced system development.
-
-