8.25

 

6.2.2.1 Organization using cloud applications and/or outsourcing IT services shall evaluate their risk tolerance level with how their outsourced IT providers handle and access their sensitive information.

 

6.2.3.1 The organization using cloud applications and/or outsourcing IT services shall:

a. Require that all their cloud service providers share an AICPA SSAE 18 or equivalent report that states that they achieved Trust Service Principles compliance or provide a documented business case as

why they chose not to;

NOTE: The organization determines equivalence to AICPA SSAE 18.

b. Evaluate their risk tolerance level with the legal jurisdictions where their outsourced providers store or use their sensitive information;

c. Ensure that their IT infrastructure and users communicate securely with all cloud services and applications; and

d. Ensure that administrative accounts for cloud services use multi-factor authentication and differ from internal administrator accounts.