Relationship with other parts of the cloud computing SLA framework
General
Conformance
Overview
General
Structure of this document
Information security components
Information security policy component
Description
Cloud service qualitative objectives
Guidance
Organization of information security component
Description
Cloud service qualitative objectives
Guidance
Asset management component
Description
Cloud service level objectives
Cloud service qualitative objectives
Guidance
Access control component
Description
Cloud service level objectives
Maximum time required to revoke user access
Time required to revoke user access at a specified commitment level
Cloud service qualitative objectives
User registration and de-registration
Review access patterns
Authentication mechanism
Third-party authentication support
Strong authentication support
Anonymous and pseudonymous authentication support
Guidance
Cryptography component
Description
Cloud service qualitative objectives
Cryptographic controls for data in motion
Cryptographic controls for data at rest
Cryptographic controls for data during execution
Key management policy
Guidance
Physical and environmental security component
Description
Cloud service qualitative objectives
Data centre monitoring
Secure disposal and re-use of equipment
Facilities authorization
Guidance
Operations security component
Description
Cloud service level objectives
Vulnerability reporting interval
Period of time of logs availability
Cloud service qualitative objectives
Malware protection
Logging and monitoring
Vulnerability management
Vulnerability notification method
Vulnerability impact statement
Guidance
Communications security component
Description
Cloud service qualitative objectives
Guidance
Systems acquisition, development and maintenance component
Description
Cloud service qualitative objectives
System acquisition procedures
Secure development procedures
Maintenance procedures
Guidance
Supplier relationships component
Description
Cloud service qualitative objectives
Guidance
Information security incident management component
Description
Cloud service level objectives
Cloud service qualitative objectives
Guidance
Business continuity management component
Description
Cloud service qualitative objectives
Guidance
Compliance component
Description
Cloud service qualitative objectives
Guidance
Protection of personally identifiable information component
Consent and choice component
Description
Cloud service qualitative objectives
Guidance
Purpose legitimacy and specification component
Description
Cloud service qualitative objectives
Purpose legitimacy
Third-party access list
Guidance
Data minimization component
Description
Cloud service level objectives
Cloud service qualitative objectives
Minimize stakeholder access
Data minimization cryptographic controls
Guidance
Use, retention and disclosure limitation component
Description
Cloud service qualitative objectives
Guidance
Accuracy and quality component
Description
Cloud service qualitative objectives
Guidance
Openness, transparency and notice component
Description
Cloud service qualitative objectives
PII subcontractor list
Requirement for specific consent
Guidance
Individual participation and access component
Description
Cloud service qualitative objectives
PII subject participation and access
PII principal access capabilities
Guidance
Accountability component
Description
Cloud service level objectives
Cloud service qualitative objectives
Notification of data breach
PII disposal policy
Guidance
Protection of PII compliance component
Description
Cloud service qualitative objectives
Guidance
Bibliography
ICS
35.210
Normen mitgestalten
Sollten Sie Verständnisprobleme zum Inhalt der Norm haben oder Hilfe bei der Anwendung benötigen, wenden Sie sich bitte an den - hier genannten - zuständigen Ansprechpartner im DIN.