From f831171a2159869e11fcb59b03e81524ca317ff5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Thu, 30 Oct 2025 15:55:07 +0100 Subject: [PATCH] feat(compliance): add C5 for GCP provider (#9097) --- api/CHANGELOG.md | 1 + api/src/backend/tasks/jobs/export.py | 2 + prowler/CHANGELOG.md | 4 +- prowler/__main__.py | 13 + prowler/compliance/gcp/c5_gcp.json | 9401 +++++++++++++++++++ prowler/lib/outputs/compliance/c5/c5_gcp.py | 92 + prowler/lib/outputs/compliance/c5/models.py | 27 + 7 files changed, 9538 insertions(+), 2 deletions(-) create mode 100644 prowler/compliance/gcp/c5_gcp.json create mode 100644 prowler/lib/outputs/compliance/c5/c5_gcp.py diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index b0442d771f..742c2ba725 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -10,6 +10,7 @@ All notable changes to the **Prowler API** are documented in this file. - Support for configuring multiple LLM providers [(#8772)](https://github.com/prowler-cloud/prowler/pull/8772) - Support C5 compliance framework for Azure provider [(#9081)](https://github.com/prowler-cloud/prowler/pull/9081) - Support for Oracle Cloud Infrastructure (OCI) provider [(#8927)](https://github.com/prowler-cloud/prowler/pull/8927) +- Support C5 compliance framework for the GCP provider [(#9097)](https://github.com/prowler-cloud/prowler/pull/9097) ## [1.14.1] (Prowler 5.13.1) diff --git a/api/src/backend/tasks/jobs/export.py b/api/src/backend/tasks/jobs/export.py index 8736a2b022..b207285676 100644 --- a/api/src/backend/tasks/jobs/export.py +++ b/api/src/backend/tasks/jobs/export.py @@ -22,6 +22,7 @@ from prowler.lib.outputs.compliance.aws_well_architected.aws_well_architected im ) from prowler.lib.outputs.compliance.c5.c5_aws import AWSC5 from prowler.lib.outputs.compliance.c5.c5_azure import AzureC5 +from prowler.lib.outputs.compliance.c5.c5_gcp import GCPC5 from prowler.lib.outputs.compliance.ccc.ccc_aws import CCC_AWS from prowler.lib.outputs.compliance.ccc.ccc_azure import CCC_Azure from prowler.lib.outputs.compliance.ccc.ccc_gcp import CCC_GCP @@ -98,6 +99,7 @@ COMPLIANCE_CLASS_MAP = { (lambda name: name.startswith("iso27001_"), GCPISO27001), (lambda name: name == "prowler_threatscore_gcp", ProwlerThreatScoreGCP), (lambda name: name == "ccc_gcp", CCC_GCP), + (lambda name: name == "c5_gcp", GCPC5), ], "kubernetes": [ (lambda name: name.startswith("cis_"), KubernetesCIS), diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index a97c666469..e72afa06a8 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -9,12 +9,12 @@ All notable changes to the **Prowler SDK** are documented in this file. - Add OCI mapping to scan and check classes [(#8927)](https://github.com/prowler-cloud/prowler/pull/8927) - `codepipeline_project_repo_private` check for AWS provider [(#5915)](https://github.com/prowler-cloud/prowler/pull/5915) - `cloudstorage_bucket_versioning_enabled` check for GCP provider [(#9014)](https://github.com/prowler-cloud/prowler/pull/9014) -- `cloudstorage_bucket_soft_delete_enabled` check for GCP provider [(#9028)](https://github.com/prowler-cloud/prowler/pull/9028) +- C5 compliance framework for Azure provider [(#9081)](https://github.com/prowler-cloud/prowler/pull/9081) +- C5 compliance framework for the GCP provider [(#9097)](https://github.com/prowler-cloud/prowler/pull/9097) ### Changed - Update AWS Direct Connect service metadata to new format [(#8855)](https://github.com/prowler-cloud/prowler/pull/8855) - Update AWS DRS service metadata to new format [(#8870)](https://github.com/prowler-cloud/prowler/pull/8870) -- C5 compliance framework for Azure provider [(#9081)](https://github.com/prowler-cloud/prowler/pull/9081) - Update AWS DynamoDB service metadata to new format [(#8871)](https://github.com/prowler-cloud/prowler/pull/8871) - Update AWS CloudWatch service metadata to new format [(#8848)](https://github.com/prowler-cloud/prowler/pull/8848) - Update AWS EMR service metadata to new format [(#9002)](https://github.com/prowler-cloud/prowler/pull/9002) diff --git a/prowler/__main__.py b/prowler/__main__.py index b0fa807e80..10a4ad7e21 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -51,6 +51,7 @@ from prowler.lib.outputs.compliance.aws_well_architected.aws_well_architected im ) from prowler.lib.outputs.compliance.c5.c5_aws import AWSC5 from prowler.lib.outputs.compliance.c5.c5_azure import AzureC5 +from prowler.lib.outputs.compliance.c5.c5_gcp import GCPC5 from prowler.lib.outputs.compliance.ccc.ccc_aws import CCC_AWS from prowler.lib.outputs.compliance.ccc.ccc_azure import CCC_Azure from prowler.lib.outputs.compliance.ccc.ccc_gcp import CCC_GCP @@ -786,6 +787,18 @@ def prowler(): ) generated_outputs["compliance"].append(ccc_gcp) ccc_gcp.batch_write_data_to_file() + elif compliance_name == "c5_gcp": + filename = ( + f"{output_options.output_directory}/compliance/" + f"{output_options.output_filename}_{compliance_name}.csv" + ) + c5_gcp = GCPC5( + findings=finding_outputs, + compliance=bulk_compliance_frameworks[compliance_name], + file_path=filename, + ) + generated_outputs["compliance"].append(c5_gcp) + c5_gcp.batch_write_data_to_file() else: filename = ( f"{output_options.output_directory}/compliance/" diff --git a/prowler/compliance/gcp/c5_gcp.json b/prowler/compliance/gcp/c5_gcp.json new file mode 100644 index 0000000000..b78afab354 --- /dev/null +++ b/prowler/compliance/gcp/c5_gcp.json @@ -0,0 +1,9401 @@ +{ + "Framework": "C5", + "Name": "Cloud Computing Compliance Criteria Catalogue C5", + "Version": "2025", + "Provider": "GCP", + "Description": "This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.", + "Requirements": [ + { + "Id": "OIS-01.01B", + "Description": "The cloud service provider operates an information security management system (ISMS) in accordance with ISO/IEC 27001. The scope of the ISMS covers the cloud service provider's organisational units, locations, zones, regions and procedures relevant to the development and operation of the cloud service.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-01 Information Security Management System (ISMS)", + "Type": "Basic", + "AboutCriteria": "The basic criterion can also be fulfilled without valid certification of the ISMS according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz, if the submitted documentation meets the requirements of ISO/IEC 27001. The auditor has to evaluate whether the documentation meets the referenced requirements of the ISO standard. This does not require a full certification audit of the management system in accordance with ISO 17021, but a focused inspection of the related documentation. Cross-sectional functions do not need to be integrated into a single ISMS. Instead, multiple ISMS can be established to cover both service-related internal control systems and central functions effectively. The scope of the ISMS may go beyond the scope of the cloud service provider's system of internal control for the cloud service in scope of an assurance engagement with this criteria catalogue. If the scope of the ISMS is broader than the scope of the assurance engagement, evidence to be obtained about the design and operation of the ISMS can be limited to records that are applicable to the cloud service in scope of the assurance engagement.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-01.02B", + "Description": "The measures for setting up, implementing, maintaining and continuously improving the ISMS are documented. The documentation includes: - Context of the cloud service provider;- Scope of the ISMS (Section 4.3 of ISO/IEC 27001);- Declaration of applicability (Section 6.1.3);- Description of how the cloud service is covered by activities in the ISMS;- Description of how the security of the cloud service is maintained and improved; and- Results of the last management review (Section 9.3).", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-01 Information Security Management System (ISMS)", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-01.03B", + "Description": "Additionally, the cloud service provider documents the scope of the cloud service that is under the cloud service provider's control and the boundaries.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-01 Information Security Management System (ISMS)", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-01.01AC", + "Description": "The Information Security Management System (ISMS) has a valid certification according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-01 Information Security Management System (ISMS)", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-02.01B", + "Description": "Top management of the cloud service provider has adopted an information security policy.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-02 Information Security Policy", + "Type": "Basic", + "AboutCriteria": "The top management is a natural person or group of persons who make the final decision for the institution and is responsible for that decision.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_role_sa_enforce_separation_of_duties", + "iam_cloud_asset_inventory_enabled", + "iam_no_service_roles_at_project_level", + "iam_role_kms_enforce_separation_of_duties", + "iam_service_account_unused", + "iam_sa_no_user_managed_keys" + ] + }, + { + "Id": "OIS-02.02B", + "Description": "Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-02 Information Security Policy", + "Type": "Basic", + "AboutCriteria": "The top management is a natural person or group of persons who make the final decision for the institution and is responsible for that decision.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-02.03B", + "Description": "The information security policy describes: - The importance of information security, based on the requirements of cloud service customers in relation to information security;- The security objectives and the desired security level, based on the business goals and activities as well as compliance obligations of the cloud service provider;- The commitment of the cloud service provider to implement the security measures required to achieve the established security objectives;- The most important aspects of the security strategy to achieve the security objectives set; and- The organisational structure for information security in the scope of the ISMS.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-02 Information Security Policy", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-02.04B", + "Description": "The cloud service provider reviews the information security policy in accordance with SP-02 on a regular basis and at least in the event of significant changes that are likely to affect the principles defined in the policy. The review process of the information security policy includes the approval and endorsement by top management.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-02 Information Security Policy", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-03.01B", + "Description": "The cloud service provider establishes, documents, and communicates the Cloud Shared Security Responsibility Model (SSRM) to define and manage interfaces and dependencies between cloud service delivery activities performed by the cloud service provider and those performed by third parties.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-03 Interfaces and Dependencies", + "Type": "Basic", + "AboutCriteria": "Third parties in the sense of this basic criterion are, e.g. cloud service customers and subservice providers. The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the guidelines and requirements for compliance with the contractual agreements with the cloud service provider (i.e., responsibilities, cooperation obligations and interfaces for reporting security incidents) are adequately defined, documented and set up." + } + ], + "Checks": [] + }, + { + "Id": "OIS-03.02B", + "Description": "The SSRM documentation clearly defines the responsibilities between both parties for handling vulnerabilities, security incidents, and malfunctions. The type and scope of the documentation is geared towards the information requirements of the subject matter experts of the affected organisations in order to carry out the activities appropriately (e.g. definition of roles and responsibilities in guidelines, description of cooperation obligations in service descriptions and contracts).", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-03 Interfaces and Dependencies", + "Type": "Basic", + "AboutCriteria": "The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-03.03B", + "Description": "The cloud service provider regularly reviews and validates the SSRM documentation to ensure its accuracy and relevance for all cloud service offerings.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-03 Interfaces and Dependencies", + "Type": "Basic", + "AboutCriteria": "The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-03.04B", + "Description": "The cloud service provider implements, operates, and assesses the SSRM components for which it is responsible, ensuring adherence to the defined security measures.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-03 Interfaces and Dependencies", + "Type": "Basic", + "AboutCriteria": "The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-03.05B", + "Description": "The communication of changes to the SSRM, interfaces and dependencies takes place in a timely manner so that the affected organisations and third parties can react appropriately with organisational and technical measures before the changes take effect.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-03 Interfaces and Dependencies", + "Type": "Basic", + "AboutCriteria": "Third parties in the sense of this basic criterion are, e.g. cloud service customers and subservice providers. The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-03.06B", + "Description": "By maintaining an up-to-date and clearly communicated SSRM, the cloud service provider ensures a comprehensive understanding of security responsibilities, fostering a secure and reliable cloud environment for all stakeholders.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-03 Interfaces and Dependencies", + "Type": "Basic", + "AboutCriteria": "The cloud service provider can define and document the interfaces and dependencies described in the basic criterion in guidelines and instructions. For example, cloud service customers' obligations to cooperate should be described in service descriptions and contracts. The cloud service provider can present the underlying Shared Responsibility Model of their cloud service in the guidelines and instructions to help cloud service customers understand their roles and responsibilities in terms of security and operational management.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-04.01B", + "Description": "Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment covers the following areas, insofar as these are applicable to the provision of the cloud service and are in the area of responsibility of the cloud service provider: - Administration of rights profiles, approval and assignment of access and access authorisations (cf. IAM-01);- Development, testing and release of changes (cf. DEV-01); and- Operation of the system components.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-04 Segregation of Duties", + "Type": "Basic", + "AboutCriteria": "Identified events that may constitute unauthorised or unintentional changes to or misuse of cloud service customer data, cloud service derived data and cloud service provider data may, for example, be treated as a security incident, cf. SIM-01.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties" + ] + }, + { + "Id": "OIS-04.02B", + "Description": "The cloud service provider implements the mitigating measures defined in the risk treatment plan, prioritising segregation of duties.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-04 Segregation of Duties", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-04.03B", + "Description": "If segregation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-04 Segregation of Duties", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OIS-04.04B", + "Description": "The cloud service provider introduces and maintains an inventory of conflicting tasks and responsibilities, including resolving measures and enforces the segregation of duties during the assignment or modification of roles as part of the role management process.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-04 Segregation of Duties", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-04.01AC", + "Description": "The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-04 Segregation of Duties", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OIS-04.02AC", + "Description": "Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-04 Segregation of Duties", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OIS-05.01B", + "Description": "The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-05 Threat Intelligence", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OIS-05.02B", + "Description": "The collected information is correlated and analysed to identify its potential impact on the cloud service provider's organisation.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-05 Threat Intelligence", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OIS-05.03B", + "Description": "The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-05 Threat Intelligence", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OIS-06.01B", + "Description": "If the cloud service is used by public sector organisations in Germany, the cloud service provider establishes and maintains contacts with the National IT Situation Centre and the CERT Association of the BSI.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-06 Contact with Relevant Government Agencies and Interest Groups", + "Type": "Basic", + "AboutCriteria": "Public sector organisations in Germany are e.g. ministries and authorities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-07.01B", + "Description": "Policies and instructions for risk management procedures are documented, communicated and provided in accordance with SP-01. Risk management procedures are based on a risk assessment methodology that enables reproducibility and comparability for the following aspects: - Identification of cybersecurity risks and other risks associated with the loss of confidentiality, integrity, availability and authenticity of information within the scope of the ISMS and assigning risk owners;- Analysis of the probability and impact of occurrence and determination of the level of risk;- Evaluation of the risk analysis based on defined criteria for risk acceptance and prioritisation of risk handling;- Treatment of risks through measures, including approval of authorisation and acceptance of residual risks by risk owners;- Documentation of the activities implemented to enable consistent, valid and comparable results; and- Conducting a review of the risk assessment and status of risk treatment plans by the management responsible for the security of the cloud service.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-07 Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "The risk level can be determined by qualitative, semi-quantitative and quantitative methods (cf. ISO 31010) based on the likelihood and impacts.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.01B", + "Description": "The cloud service provider executes the process for handling risks as needed or at least once a year.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.02B", + "Description": "The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud service derived data with different protection needs;- Occurrence of vulnerabilities and malfunctions in technical protective measures for separating shared resources;- Attacks via access points, including interfaces accessible from public networks and accidentally exposed interfaces;- Conflicting tasks and areas of responsibility that cannot be separated for organisational or technical reasons;- Dependencies on subservice organisations;- An encryption and key management risk programme which addresses the risks of unauthorised disclosure, modification, destruction, or information loss of cryptographic keys; and- Segregation of cloud users and their data within systems, networks and storage.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'. Shared resources are e.g. networks, RAM or storage. When determining protection needs of customer data, regulatory requirements applicable to customer data should be considered such as PCI-DSS, HIPAA, DORA (regulation on digital operational resilience for the financial sector and amending regulations), NIS 2 Directive and KRITIS.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "compute_instance_encryption_with_csek_enabled", + "dataproc_encrypted_with_cmks_disabled", + "dns_rsasha1_in_use_to_key_sign_in_dnssec", + "dns_rsasha1_in_use_to_zone_sign_in_dnssec", + "compute_network_default_in_use", + "compute_network_dns_logging_enabled", + "compute_public_address_shodan", + "compute_instance_ip_forwarding_is_enabled", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_block_project_wide_ssh_keys_disabled", + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "OIS-08.03B", + "Description": "The cloud service provider implements the policies and procedures covering risk assessments on the entire cloud service.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.04B", + "Description": "The results of the risk assessments are made available to relevant internal parties.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.05B", + "Description": "Information, specific for their purposes, is made available to relevant external parties.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.06B", + "Description": "The analysis, evaluation and treatment of risks, including the approval of actions and acceptance of residual risks, is reviewed by the risk owners for adequacy at least annually, and after each significant change that may affect the security of the cloud service.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.07B", + "Description": "The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.08B", + "Description": "The cloud service provider prioritises the risk treatment according to the level of cyber risks related to the cloud service.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled" + ] + }, + { + "Id": "OIS-08.09B", + "Description": "The cloud service provider documents and implements a risk treatment plan based on the risk assessment (OIS-07).", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_automated_backups", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OIS-08.10B", + "Description": "The risk treatment plan reduces the risk level to a residual risk acceptable to the risk owners.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.11B", + "Description": "The risk treatment plan is made available to relevant internal parties, including appropriately summarised and abstracted versions.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.12B", + "Description": "The cloud service provider determines if relevant external parties shall receive information, specific to their purposes, about the risk treatment plan and to what extent this should happen.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.13B", + "Description": "The risk treatment plan is reviewed by the cloud service provider every time the risk assessment is modified and formally accepted by the risk owners.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.14B", + "Description": "If the cloud service provider shares risks with the cloud service customers, the shared risks are associated with complementary customer controls and described in the user documentation.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Basic", + "AboutCriteria": "This criterion applies only to risks that reside within the area of responsibility of the cloud service provider. Risks that arise for the cloud service customer when using the cloud service are not covered by this criterion. When outsourcing activities for the provision of cloud services to subservice organisations, the responsibility for these risks remains with the cloud service provider. Requirements for measures to manage these risks can be found in the criteria area 'Control and Monitoring of Service Providers and Suppliers (SSO)'.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-08.01AC", + "Description": "The cloud service provider integrates information security risks into a documented Enterprise Risk Management (ERM) programme which addresses the following aspects: - Integration of information security risks at the enterprise level to promote information security risk-awareness across the entire organisation;- Leadership awareness and support for identification, analysis and treatment of information security risks to foster continuous improvement;- Consideration of the cloud service provider's strategic objectives when managing risks to align risk treatment with the organisation's goals; and- Review of information security risks at least on an annual basis.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-08 Application of the Risk Management Policy", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OIS-09.01B", + "Description": "Information security is considered in project management. The cloud service provider performs a risk assessment according to OIS-07 and, if necessary, proceeds with risk treatment to assess and treat the risks on all projects that may affect the provision of the cloud service, regardless of the nature of the project.", + "Attributes": [ + { + "Section": "Organisation of Information Security (OIS)", + "SubSection": "OIS-09 Information Security in Project Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-01.01B", + "Description": "Policies and instructions (incl. concepts and guidelines) are derived from the information security policy and are documented according to a uniform structure. The policies and instructions describe at least the following aspects: - Objectives;- Scope;- Roles and responsibilities, including staff qualification requirements and the establishment of substitution rules;- Roles and dependencies on other organisations (especially cloud service customers and subservice organisations);- Steps for the execution of the security strategy; and- Applicable legal and regulatory requirements.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-01 Documentation, Communication and Provision of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Policies and instructions are required for the following basic criteria in which the content is specified in more detail: - Risk Management Policy (OIS-07);- Policy for Remote Working (HR-07);- Asset Management Concept (AM-01);- Acceptable Use and Safe Handling of Assets Policy (AM-05);- Policy for Removable Media and Endpoint Devices (AM-12);- Physical Security and Environmental Control Requirements (PS-01);- Physical Site Access Control (PS-04);- Workplace Security Requirements (PS-08);- Protection Against Malware - Concept (OPS-04);- Data Backup and Recovery - Concept (OPS-06);- Logging and Monitoring - Concept (OPS-10);- Logging and Monitoring - Metadata Management Concept (OPS-11);- Managing Vulnerabilities - Concept (OPS-18);- Managing Incidents and Crashes - Concept (OPS-19);- Separation of Datasets - Guideline (OPS-28);- Confidential Computing - Policies and Instructions (OPS-30);- Guideline for Container Management (OPS-32);- Managing Vulnerabilities - Patch Management (OPS-33);- Policy for User Accounts and Access Rights (IAM-01);- Authentication Mechanisms (authentication policy) (IAM-09);- Policy for the Use of Cryptographic Mechanisms (CRY-01);- Technical Safeguards (COS-01);- Policies for Data Transmission (COS-08);- Policies for Changes to System Components (DEV-03);- Development Service Organisations Security (policies and instructions for the use of third party and open source software) (DEV-14);- Policies and Instructions for Controlling and Monitoring Service Organisations (SSO-01);- Controlling Exchanges with Suppliers of Functional Components (SSO-08);- Policy for Security Incident Management (SIM-01);- Business Continuity and Emergency Management System (BCM-01);- Policy for Business Continuity Management (BCM-05);- Policy for Planning and Conducting Audits (COM-02); and- Communication of Technical Procedures for Data Disclosure in Investigation Requests (INQ-05).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-01.02B", + "Description": "The policies and instructions are communicated and made available to all internal and external employees of the cloud service provider in an appropriate manner.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-01 Documentation, Communication and Provision of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "The appropriateness of the demand-oriented communication and provision should be assessed against the size and complexity of the cloud service provider's organisation and the type of cloud service offered. Possible criteria are: - Integration of guidelines and instructions in the onboarding of new employees;- Training and information campaigns when adopting new or revising existing policies and instructions; and- Form of provision.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-01.03B", + "Description": "The policies and instructions are subject to version control.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-01 Documentation, Communication and Provision of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-01.04B", + "Description": "The policies and instructions are approved by the top management of the cloud service provider or an authorised body.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-01 Documentation, Communication and Provision of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-01.05B", + "Description": "The responsible business units of the cloud service provider shall report at least annually to the top management on the policies and instructions and their implementation. This reporting includes at least: - Implemented changes to address cybersecurity risks for the topic addressed in the policy or instruction;- Information security incidents for the topic addressed in the policy or instruction and the follow-up;- Performance of the internal controls regarding information security for the topic addressed in the policy or instruction (cf. COM-04); and- Planned changes for the topic addressed in the policy or instruction to address cybersecurity risks and information security and cybersecurity.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-01 Documentation, Communication and Provision of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-02.01B", + "Description": "Information security policies and instructions are reviewed for adequacy by the cloud service provider's subject matter experts at least annually, and when significant changes may affect the security of the cloud service. The review shall consider at least the following aspects: - Organisational and technical changes in the procedures for providing the cloud service; and- Legal and regulatory changes in the cloud service provider's environment.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-02 Review and Approval of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-02.02B", + "Description": "Revised policies and instructions are approved by the appropriate level of management before they become effective and are communicated and made available to internal and external employees.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-02 Review and Approval of Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.01B", + "Description": "The cloud service provider maintains a list of exceptions to the policies and instructions for information security, including associated controls.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they obtain information from the cloud service provider about deviations from information security policies and instructions in order to assess and appropriately manage the associated risks to their own information security." + } + ], + "Checks": [] + }, + { + "Id": "SP-03.02B", + "Description": "Exceptions to the policies and instructions for information security as well as respective controls go through risk management procedures in accordance with OIS-07, including approval of these exceptions and acceptance of the associated risks by the risk owners.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.03B", + "Description": "The approvals of exceptions are documented.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.04B", + "Description": "The approvals of exceptions are limited in time.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.05B", + "Description": "The approvals of exceptions are reviewed for appropriateness at least annually by the risk owners.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.06B", + "Description": "Exceptions leading to a nonconformity to any of the certification requirements of a certified cloud service are not allowed.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.01AC", + "Description": "The exceptions to policies or instructions are approved by the appropriate level of management who approved the policies or instructions.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Additional (Complementing)", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.02AC", + "Description": "The list of exceptions is monitored to ensure that the approved exceptions have not expired and that all reviews and approvals are up-to-date.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Additional (Complementing)", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SP-03.03AC", + "Description": "Any exceptions for which deviations were identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Security Policies and Instructions (SP)", + "SubSection": "SP-03 Exceptions from Existing Policies and Instructions", + "Type": "Additional (Complementing)", + "AboutCriteria": "Exceptions in the sense of the criterion can have organisational or technical causes, such as: - An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and- A system component lacks technical properties to configure it according to the applicable requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-01.01B", + "Description": "The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service in the production environment.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-01 Verification of Qualification and Trustworthiness", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties", + "iam_sa_no_administrative_privileges", + "bigquery_dataset_public_access", + "kms_key_not_publicly_accessible", + "cloudsql_instance_public_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ] + }, + { + "Id": "HR-01.02B", + "Description": "The competency and integrity of all internal and external employees to which these roles are assigned is verified prior to employment. The verification considers the following measures, to the extent permitted by local legislation and regulation and as considered appropriate by the cloud service provider to mitigate risks related to inappropriate access to the respective data type: - Verification of the person's identity via identity card or passport;- Verification of professional experience through the CV;- Verification of academic titles and degrees;- Request for a certificate of good conduct, police clearance or other national equivalents; and- Evaluation of susceptibility to blackmail.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-01 Verification of Qualification and Trustworthiness", + "Type": "Basic", + "AboutCriteria": "External employees in the sense of the criteria are those who perform activities in accordance with the processes and procedures of the cloud service provider. Employees of service organisations who perform activities according to the service organisation's own processes and procedures are not covered by this criterion. Permissible verifications of competency and integrity may vary based on local law as well as the role of the employee. Depending on these factors and the nature of the checks conducted, explicit consent by the employee may be necessary. The verification of qualification and trustworthiness can be supported by specialised service providers or be based on voluntary self-disclosure of the employee. Depending on national legislation, national equivalents of the German certificate of good conduct ('Führungszeugnis') may also be permitted. Assessing the vulnerability of a potential employee to blackmail can involve evaluating their creditworthiness. However, this assessment may only be legally permissible for positions with significant financial responsibility, depending on local regulations. Risks related to inappropriate access to cloud service customer data may be mitigated by the use of encryption or monitoring system access for suspicious events. Although such measures are not supposed to completely substitute the above-mentioned verification measures, the extent of such measures may be reduced.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-01.03B", + "Description": "The cloud service provider follows-up changes in work-related personal situations and identifies and mitigates related risks.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-01 Verification of Qualification and Trustworthiness", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-01.04B", + "Description": "The cloud service provider assesses the competence and integrity of its personnel before commencement of employment in a position with a higher risk classification than their current position within the company.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-01 Verification of Qualification and Trustworthiness", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-01.05B", + "Description": "The extent of the assessment defined in this requirement is proportional to the business context, the sensitivity of the information that will be accessed by the personnel, and the associated risks.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-01 Verification of Qualification and Trustworthiness", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-01.01AC", + "Description": "The cloud service provider reviews annually their assessment of the competence and integrity of its personnel for the individuals in positions with the highest levels of risk classification, starting at a level to be defined in the human resource policy.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-01 Verification of Qualification and Trustworthiness", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-02.01B", + "Description": "The cloud service provider's internal and external employees are required by employment terms and conditions to comply with the information security policy, the policies, procedures and instructions based on it, and the code of ethics.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-02 Employment Terms and Conditions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-02.02B", + "Description": "The cloud service provider ensures that the terms for all internal and external employees include a non-disclosure provision. The non-disclosure provision covers any information that has been obtained or generated as part of the cloud service, even if anonymised and decontextualised.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-02 Employment Terms and Conditions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-02.03B", + "Description": "The cloud service provider gives a presentation of the information security policy, the policies, procedures and instructions based on it and the code of ethics.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-02 Employment Terms and Conditions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-02.04B", + "Description": "The cloud service provider requires the information security policy, the policies, procedures and instructions based on it and the code of ethics to be acknowledged by the internal and external personnel in a documented form before access is granted to any cloud service customer data, cloud service derived data, cloud service provider data and account data or system components under the responsibility of the cloud service provider used to provide the cloud service in the production environment.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-02 Employment Terms and Conditions", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.01B", + "Description": "The cloud service provider operates a target group-oriented security awareness and training programme.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.02B", + "Description": "All internal and external employees of the cloud service provider undergo a role-based programme at least annually, and when changing target group, taking into consideration at least their position's risk classification and technical duties.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.03B", + "Description": "The programme is regularly updated based on changes to policies and instructions and the current threat situation and includes the following aspects insofar as they are applicable to each employee's role: - Handling system components used to provide the cloud service in the production environment in accordance with applicable policies and procedures;- Handling cloud service customer data, cloud service derived data, cloud service provider data and account data in accordance with applicable policies and instructions and applicable legal and regulatory requirements;- Information about the current threat situation;- Correct behaviour in the event of security incidents;- Security best practices; and- Secure development.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.01AC", + "Description": "The cloud service provider monitors the completion of the security awareness and training programme.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.02AC", + "Description": "Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "HR-03.03AC", + "Description": "The learning outcomes achieved through the awareness and training programme are measured and evaluated in a target group-oriented manner.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Additional (Complementing)", + "AboutCriteria": "The measurement and evaluation of learning outcomes in a target group-oriented manner, as specified by the additional criterion, do not require assessing each employee individually. Instead, evaluations can be performed at an aggregated level, focusing on the overall effectiveness of the training program for specific target groups. This approach allows for the identification of trends and areas for improvement within the program while respecting employees' privacy requirements.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.04AC", + "Description": "The measurements cover quantitative and qualitative aspects.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-03.05AC", + "Description": "The results are used to improve the awareness and training programme.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-03 Security Training and Awareness Programme", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-04.01B", + "Description": "The cloud service provider classifies information of security-sensitive positions according to their level of risk, including positions related to IT administration and all positions with access to cloud service customer data or system components for the provisioning of the cloud service in the production environment.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-04 Disciplinary Measures", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-04.02B", + "Description": "In the event of violations of policies and instructions or applicable legal and regulatory requirements, actions are taken in accordance with a defined policy that includes the following aspects: - Verifying whether a violation has occurred; and- Consideration of the nature and severity of the violation and its impact.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-04 Disciplinary Measures", + "Type": "Basic", + "AboutCriteria": "The cloud service provider ensures that the policies and instructions reflect applicable legal and regulatory requirements in accordance with SP-01.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-04.03B", + "Description": "The internal and external employees of the cloud service provider are informed about possible disciplinary measures.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-04 Disciplinary Measures", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-04.04B", + "Description": "The use of disciplinary measures is appropriately documented.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-04 Disciplinary Measures", + "Type": "Basic", + "AboutCriteria": "With regards to the use of disciplinary measures, the submission of anonymised evidence is acceptable and does not imply that the basic criterion is not fully fulfilled.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-04.01AC", + "Description": "In case of a security breach, the cloud service provider is prepared to inform affected cloud service customers about the disciplinary actions taken against involved personnel, if requested by the customers.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-04 Disciplinary Measures", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-05.01B", + "Description": "Internal and external employees have been informed about which responsibilities, arising from employment terms and conditions relating to information security, will remain in place when their employment is terminated or changed and for how long.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-05 Responsibilities in the Event of Termination or Change of Employment", + "Type": "Basic", + "AboutCriteria": "The cloud service provider ensures that the employment terms and conditions reflect applicable legal and regulatory requirements in accordance with SP-01.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-05.02B", + "Description": "The cloud service provider applies a specific procedure to revoke the access rights and to process the identities and assets of internal and external employees appropriately when their engagement is terminated or changed. This procedure includes defining specific roles and responsibilities as well as a documented checklist of all required steps.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-05 Responsibilities in the Event of Termination or Change of Employment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-06.01B", + "Description": "The non-disclosure or confidentiality agreements to be agreed with internal employees, external service providers and suppliers of the cloud service provider are based on the requirements identified by the cloud service provider for the protection of confidential information and operational details.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-06 Non-disclosure Agreements", + "Type": "Basic", + "AboutCriteria": "A non-disclosure agreement should cover: - Which information or data types must be kept confidential;- The period for which this confidentiality agreement applies;- What actions must be taken upon termination of this agreement, e.g. destruction or return of data medium;- How the ownership of information is regulated;- What rules apply to the use and disclosure of confidential information to other partners, if necessary; and- The consequences of a breach of the agreement.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-06.02B", + "Description": "The agreements are to be accepted by external service providers and suppliers when the contract is agreed.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-06 Non-disclosure Agreements", + "Type": "Basic", + "AboutCriteria": "Confidentiality or non-disclosure agreements should be signed by means of an electronic signature, insofar as this is legally binding.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-06.03B", + "Description": "The agreements are to be accepted by internal employees of the cloud service provider before authorisation to access cloud service customer data, cloud service derived data, cloud service provider data and account data is granted.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-06 Non-disclosure Agreements", + "Type": "Basic", + "AboutCriteria": "Confidentiality or non-disclosure agreements should be signed by means of an electronic signature, insofar as this is legally binding.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-06.04B", + "Description": "The requirements are documented and reviewed at regular intervals (at least annually). If the review shows that the requirements need to be adapted, the non-disclosure or confidentiality agreements are updated.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-06 Non-disclosure Agreements", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-06.05B", + "Description": "The cloud service provider informs the internal employees, external service providers and suppliers and obtains confirmation of the updated confidentiality or non-disclosure agreement.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-06 Non-disclosure Agreements", + "Type": "Basic", + "AboutCriteria": "Confidentiality or non-disclosure agreements should be signed by means of an electronic signature, insofar as this is legally binding.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-06.06B", + "Description": "In instances where agreement on the updates cannot be reached, the cloud service provider shall assess the resulting risks to information security according to OIS-07.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-06 Non-disclosure Agreements", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "HR-07.01B", + "Description": "Policies and instructions for the protection of information when employees work remotely are documented, communicated and provided in accordance with SP-01 and address the following aspects: - Assessment of the security of remote working locations;- Establishing guidelines for the safe handling and storage of sensitive information and data types;- Definition of remote access security requirements;- Utilisation of secure communication methods and enforcement of secure network use; and- Provision of organisation-approved equipment and prohibition of unregulated personal devices.", + "Attributes": [ + { + "Section": "Personnel (HR)", + "SubSection": "HR-07 Policy for Remote Working", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-01.01B", + "Description": "An asset management concept is documented, communicated and provided according to SP-01, in which the following aspects are described: - Identification of assets which are used to provide the cloud service in the production environment;- Definition of a scheme for identifying protection requirements based on information processed on the asset;- Definition of asset types, considering at a minimum the differentiation of hardware and software objects;- Definition of asset lifecycles based on the asset type; and- Definition of procedures for inventory of hardware and software assets.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-01 Asset Management Concept", + "Type": "Basic", + "AboutCriteria": "Assets within the meaning of this domain are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These objects consist of hardware and software objects. Hardware objects are: - Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and- End user devices if the cloud service provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication). Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs). The lifecycle of an asset includes, depending on the asset type: - Acquisition;- Commissioning;- Maintenance;- Decommissioning; and- Disposal.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-01.01AC", + "Description": "The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service customers in accordance with contractual agreements.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-01 Asset Management Concept", + "Type": "Additional (Complementing)", + "AboutCriteria": "Assets within the meaning of this domain are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These objects consist of hardware and software objects. Hardware objects are: - Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and- End user devices if the cloud service provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication). Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs). The lifecycle of an asset includes, depending on the asset type: - Acquisition;- Commissioning;- Maintenance;- Decommissioning; and- Disposal.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "AM-01.02AC", + "Description": "The cloud service provider monitors the process that is maintaining the inventory of assets to assure this inventory is up-to-date.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-01 Asset Management Concept", + "Type": "Additional (Complementing)", + "AboutCriteria": "Assets within the meaning of this domain are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These objects consist of hardware and software objects. Hardware objects are: - Physical and virtual infrastructure resources (e.g. servers, storage systems, network components); and- End user devices if the cloud service provider has determined in a risk assessment that these could endanger the information security of the cloud service in the event of loss or unauthorised access (e.g. mobile devices used as security tokens for authentication). Software objects are e.g. hypervisors, containers, operating systems, databases, microservices and programming interfaces (APIs). The lifecycle of an asset includes, depending on the asset type: - Acquisition;- Commissioning;- Maintenance;- Decommissioning; and- Disposal.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-02.01B", + "Description": "The cloud service provider maintains an asset inventory of hardware and software assets in accordance with the asset management concept.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-02 Asset Inventory", + "Type": "Basic", + "AboutCriteria": "Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-02.02B", + "Description": "The inventory is performed automatically and/or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset lifecycle.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-02 Asset Inventory", + "Type": "Basic", + "AboutCriteria": "Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-02.03B", + "Description": "Assets are recorded with the information needed to apply the risk management procedure (cf. OIS-07), including the measures taken to manage these risks throughout the asset lifecycle.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-02 Asset Inventory", + "Type": "Basic", + "AboutCriteria": "Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-02.04B", + "Description": "Changes to the recorded information are logged.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-02 Asset Inventory", + "Type": "Basic", + "AboutCriteria": "Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-02.05B", + "Description": "The inventory system maintained by the cloud service provider can provide a detailed list of all users who have access to a specific resource, along with their respective access rights.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-02 Asset Inventory", + "Type": "Basic", + "AboutCriteria": "Cloud service providers who procure their cloud infrastructure as virtual infrastructure from subservice providers (e.g. virtual machines or containers) may use tools provided by the subservice provider to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management concept.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-03.01B", + "Description": "The hardware asset inventory maintained by the cloud service provider includes the following details for each entry: - Identification details (such as name, IP address, MAC address, etc.);- The function of the asset;- The model of the asset;- The location of the asset;- The owner of the asset; and- Information security requirements for the asset.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-03 Hardware Asset Inventory", + "Type": "Basic", + "AboutCriteria": "An 'Asset Owner' is an individual or role assigned with the responsibility and accountability for managing and protecting an organisation's asset and does not imply legal ownership of the assets. If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider should inventory the containers and document their life cycle (cf. OPS-32)", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-04.01B", + "Description": "The cloud service provider maintains a comprehensive inventory of all software assets, including used software. This inventory includes the following details for each software asset: - Identification details (such as name, IP address, MAC address, etc.);- The version of the software; and- The devices on which the software is installed.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-04 Software Asset Inventory", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-05.01B", + "Description": "Policies and instructions for the proper and secure use of assets are documented, communicated and provided in accordance with SP-01 and address the following aspects of the asset lifecycle as applicable to the asset: - Approval procedures for acquisition, commissioning, maintenance, decommissioning, and disposal by authorised personnel or system components;- Inventory;- Classification and labelling based on the need for protection of the cloud service customer data, cloud service derived data, cloud service provider data and account data as well as measures for the level of protection identified;- Secure configuration of mechanisms for error handling, logging, encryption, authentication and authorisation;- Requirements for versions of software and images as well as application of patches;- Handling of software for which support and security patches are not available anymore;- Restriction of software installations or use of services;- Protection against malware;- Remote deactivation, deletion or blocking;- Physical delivery and transport;- Dealing with incidents and vulnerabilities;- Complete and irrevocable deletion of the data upon decommissioning; and- Secure handling and usage of removable media, e.g. by specifying which devices are permitted to interact with removable media and what data can be stored on them or by banning the reuse of removable media.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-05 Policy for the proper and secure use of assets", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-05.02B", + "Description": "The applicability of these aspects is defined based on the cloud service provider's asset management concept (cf. AM-01).", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-05 Policy for the proper and secure use of assets", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-06.01B", + "Description": "The cloud service provider has implemented an approval process for commissioning hardware used to provide the cloud service in the production environment. This process involves identifying, analysing, and mitigating any risks (cf. OIS-07) associated with the commissioning.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-06 Commissioning of Hardware", + "Type": "Basic", + "AboutCriteria": "The criterion applies only to physical hardware objects, such as servers, storage systems, and network components. Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV). The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-06.02B", + "Description": "Approval is granted after verification of the secure configuration of the mechanisms for error handling, logging, encryption, authentication and authorisation according to the intended use and based on the applicable policies.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-06 Commissioning of Hardware", + "Type": "Basic", + "AboutCriteria": "The criterion applies only to physical hardware objects, such as servers, storage systems, and network components. Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV). The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-07.01B", + "Description": "The cloud service provider defines, documents and implements a procedure for the decommissioning of hardware used to operate system components supporting the cloud service production environment under the responsibility of the cloud service provider. As part of this procedure, approval by authorised personnel of the cloud service provider based on the applicable policies is required.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-07 Decommissioning of Hardware", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-07.02B", + "Description": "The decommissioning includes the complete and permanent deletion of all cloud service customer data, cloud service derived data, cloud service provider data and account data or proper destruction of the media. However, account data is only to be deleted if the data is located in the production environment for the operation of system components.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-07 Decommissioning of Hardware", + "Type": "Basic", + "AboutCriteria": "The deletion of data or physical destruction of data mediums can take place, for example, according to DIN 66399 or BSI IT-Grundschutz module CON.6.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudstorage_bucket_soft_delete_enabled" + ] + }, + { + "Id": "AM-07.01AC", + "Description": "The cloud service provider requires approval for the disposal of any hardware used outside the organisation's premises.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-07 Decommissioning of Hardware", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-07.02AC", + "Description": "Additionally, the destruction of data on such hardware is carried out in a manner that ensures that data recovery is impossible.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-07 Decommissioning of Hardware", + "Type": "Additional (Complementing)", + "AboutCriteria": "The deletion of data or physical destruction of data mediums can take place, for example, according to DIN 66399 or BSI IT-Grundschutz module CON.6.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-08.01B", + "Description": "The cloud service provider determines in a risk assessment (cf. OIS-07) if loss of or unauthorised access to assets could compromise the information security of the cloud service. If so, the cloud service provider's internal and external employees are provably committed to the policies and instructions for proper use and safe and secure handling of assets before they can be used.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets", + "Type": "Basic", + "AboutCriteria": "The criterion essentially concerns mobile devices (e.g. notebooks, tablets, smartphones, etc.), especially if confidential information is stored on them that can be used, in the event of unauthorised access, to obtain privileged access to the cloud service (e.g. if these are used as security tokens for authentication).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-08.02B", + "Description": "Any assets handed over are provably returned upon termination of employment.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets", + "Type": "Basic", + "AboutCriteria": "The criterion essentially concerns mobile devices (e.g. notebooks, tablets, smartphones, etc.), especially if confidential information is stored on them that can be used, in the event of unauthorised access, to obtain privileged access to the cloud service (e.g. if these are used as security tokens for authentication).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-09.01B", + "Description": "Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Basic", + "AboutCriteria": "If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the need for protection of the information that can be processed or stored with the cloud service is adequately determined. Cloud service customers ensure through suitable controls that the information processed or stored with the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with its protection needs." + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "AM-09.02B", + "Description": "Classification levels are reviewed at least annually and updated, where appropriate.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Basic", + "AboutCriteria": "If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-09.03B", + "Description": "The need for protection is determined by the individuals or groups responsible for the assets of the cloud service provider according to a uniform and documented classification schema.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Basic", + "AboutCriteria": "If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-09.04B", + "Description": "The classification schema provides levels of protection for the confidentiality, integrity, availability, and authenticity protection objectives. These protection objectives are aligned with delivery and recovery objectives set out in business and disaster recovery plans.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Basic", + "AboutCriteria": "If the cloud service provider does not categorize the assets specifically, then all assets may be treated as requiring the highest level of protection needs.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-09.01AC", + "Description": "All physical assets are uniquely identified. This unique identification of devices serves as an additional method for connection authentication.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Additional (Complementing)", + "AboutCriteria": "To ensure that all physical assets are uniquely identified, the cloud service provider may implement practices such as: - Use of a centralised device management platform to monitor and control all devices;- Assigning unique identifiers (e.g. MAC addresses, serial numbers) to all devices; and- Use of automated mechanisms to register connecting devices.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-09.02AC", + "Description": "Device identification is integrated into the asset classification and labeling processes.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-09.03AC", + "Description": "Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "AM-09.04AC", + "Description": "Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-09 Asset Classification and Labelling", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-10.01B", + "Description": "The cloud service provider has documented and implemented a procedure for protecting hardware that is temporarily not in use. The procedure ensures that inactive hardware is stored securely and protected against unauthorised access or damage until it is needed again.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-10 Protection of Hardware on Hold", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-11.01B", + "Description": "The cloud service provider ensures the secure and controlled transfer of hardware used in the cloud service production environment to an offsite or alternate location.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-11 Transfer of Hardware", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-11.02B", + "Description": "The transfer of hardware is authorised by designated personnel.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-11 Transfer of Hardware", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-11.03B", + "Description": "The transfer of hardware is conducted using secure methods to prevent unauthorised access, tampering, or loss during transit.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-11 Transfer of Hardware", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-12.01B", + "Description": "Policies and instructions for endpoint devices and removable storage media are documented, communicated and provided in accordance with SP-01 regarding the following aspects: - The use of removable media is forbidden except for unavoidable essential system administration actions, and then only in the event that no other mechanism is possible;- Use of removable media is dedicated to a single specific purpose;- The decision to use removable media is documented;- Storage encryption is enabled on managed endpoints and removable storage media to protect information from unauthorised disclosure;- Managed endpoints are configured with anti-malware detection and prevention technology and services;- Self-execution from removable storage is disabled and storage media is scanned before use on the cloud service provider's systems;- Measures are to be taken by users to protect mobile endpoints and removable storage in transit and in storage;- Protection during the transfer of any equipment containing cloud service customer data off-site for disposal to guarantee that the level of protection in terms of confidentiality and integrity of the assets during their transport is equivalent to that on the site;- Sharing equipment containing media with data (including cloud service customer data and cloud service derived data) with a third party only if the data (including cloud service customer data and cloud service derived data) stored on it is encrypted in accordance with CRY-05 or has been destroyed beforehand using a secure deletion mechanism;- Users are to use mobile endpoints and removable storage in a secure manner, this includes for example not leaving media openly accessable in public spaces, using screen locks and screen privacy films; and- Measures for maintaining proper security of third party endpoints with access to organisational assets are to be defined.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-12 Policy for Removable Media and Endpoint Devices", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "AM-12.01AC", + "Description": "Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment (cf. OIS-07);- Remote geo-location capabilities are enabled for all managed mobile endpoints; and- Define, implement and evaluate processes, procedures and technical measures to enable the deletion of company data remotely on managed endpoint devices.", + "Attributes": [ + { + "Section": "Asset Management (AM)", + "SubSection": "AM-12 Policy for Removable Media and Endpoint Devices", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_network_default_in_use", + "compute_network_dns_logging_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed" + ] + }, + { + "Id": "PS-01.01B", + "Description": "The cloud service provider defines and documents at least two security areas, with at least one sensitive area covering sensitive activities such as the buildings and premises hosting the information system for the provision of the cloud service, and at least one public area covering all remaining buildings and premises, not covered by other security areas.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Basic", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.02B", + "Description": "Security requirements for premises and buildings related to the cloud service provided are based on the security objectives of the information security policy, identified protection requirements for the cloud service and the assessment of risks to physical and environmental security. The security requirements are documented, communicated and provided in a policy or concept according to SP-01.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Basic", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.03B", + "Description": "Security requirements for data centres are based on criteria in accordance with established rules of technology and the criteria PS-02 to PS-07. They are suitable for addressing the following risks in accordance with the applicable legal and contractual requirements: - Faults in planning;- Unauthorised access;- Insufficient surveillance;- Lightning and overvoltage (aligned with the internationally harmonised standards of IEC 62305);- Fire and smoke;- Unwanted water;- Failures and/or unavailable telecommunications;- Power failure; and- Heating, ventilation, airconditioning (HVAC) and filtration.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Basic", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. The recognised established rules of technology are defined in relevant standards, e.g. EN 50600 (facilities and infrastructures of data centres). Note for German readers: The German version of C5 uses the term *Stand der Technik* for established rules of technology although the German reader might expect the term *state of the art*. Without discussing the semantic, please note that *state of the art* defines a higher level than *Stand der Technik* and therefore *established rules of technology* is used here.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.04B", + "Description": "The maximum tolerable downtimes of utility facilities are suitable for meeting the availability requirements contained in the service level agreement.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Basic", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.05B", + "Description": "If the cloud service provider operates the cloud service in data centres operated by service organisations, the document describes the complementary subservice organisation controls (CSOC) expected at the service organisations and the measures for monitoring the design and operation of controls at the service organisations with respect to these CSOC (cf. SSO-05).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Basic", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. Premises and buildings operated by third parties are e.g. server housing, colocation, IaaS.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.06B", + "Description": "The appropriate and effective verification of implementation is carried out in accordance with the criteria for controlling and monitoring subcontractors (cf. SSO-01, SSO-02).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Basic", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.01AC", + "Description": "The security requirements include time constraints for self-sufficient operation in the event of exceptional events (e.g. prolonged power outage, heat waves, low water in cold river water supply) and maximum tolerable utility downtime.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Additional (Complementing)", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. Time specifications for self-sustaining operation as well as maximum tolerable downtimes of utility facilities are typically collected during the business impact analysis (cf. BCM-02, BCM-03).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.02AC", + "Description": "The time limits for self-sufficient operation provide for at least 72 hours in the event of a failure of the external power supply.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Additional (Complementing)", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08. The 72-hour timeframe for self-sufficient operation aligns with guidelines for government agencies, businesses and critical infrastructure operators (KRITIS) as per the Federal Office for Civil Protection and Disaster Assistance (BBK).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.03AC", + "Description": "For a self-sufficient operation during a heat period, the highest outside temperatures measured to date at the three nearest official measurement stations around the locations of the premises and buildings have been determined with a safety margin of 3 K.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Additional (Complementing)", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.04AC", + "Description": "The security requirements stipulate that the permissible operating and environmental parameters of the cooling supply shall also be maintained on at least five consecutive days with these outside temperatures including the safety margin (cf. PS-06).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Additional (Complementing)", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-01.05AC", + "Description": "If water is taken from a river for air conditioning, it is determined at which water levels and water temperatures the air conditioning can be maintained for how long.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-01 Physical Security and Environmental Control Requirements", + "Type": "Additional (Complementing)", + "AboutCriteria": "Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply. Premises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud service customer data (including data centres for backup or redundancy purposes) and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Premises and buildings in which no data from cloud service customers is processed or stored (e.g. offices of the cloud service provider, server rooms with system components for internal development and test systems) adhere to requirements specifically covered under PS-08.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-02.01B", + "Description": "The cloud service is provided from at least two locations that provide each other with operational redundancy and resilience. The locations meet the security requirements of the cloud service provider (cf. PS-01) and are located in an adequate distance to each other to achieve operational redundancy.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-02 Redundancy Model", + "Type": "Basic", + "AboutCriteria": "Operational redundancy of the sites to each other in the sense of this criterion is given if based on the assessment of elementary risks at the site corresponding distances of the premises and buildings to these risks are maintained. Very extensive events which, due to their extent, could affect several sites of the same redundancy group simultaneously or in a timely manner (e.g. floods, earthquakes) are not considered. There are cloud service providers who no longer address the issue of reliability of the cloud service on a physical level through redundancy from two independent locations, but through resilience. The cloud service is provided simultaneously from more than two locations. The underlying distributed data centre architecture ensures that the failure of a location or components of a location does not violate the defined availability criteria of the cloud service. Such an architecture can represent an alternative fulfilment (cf. Chapter 3.4.8) of the criterion. The tests and exercises on functionality required in the criterion also apply analogously to resilient architectures.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the existing redundancy model of the cloud service provider and the evidence for the verification of the model comply with their own requirements for the availability and reliability of the cloud service." + } + ], + "Checks": [] + }, + { + "Id": "PS-02.01AS", + "Description": "The cloud service is provided from more than two locations that provide each other with redundancy. The locations are sufficiently far apart to achieve georedundancy. If two locations fail at the same time, at least one third location is still available to prevent a total service failure.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-02 Redundancy Model", + "Type": "Additional (Sharpening)", + "AboutCriteria": "A georedundancy of the sites to each other in the sense of this criterion is given if a very extensive event at a site under no circumstances affects several sites of the same redundancy group simultaneously or promptly. The BSI publication 'Kriterien für die Standortwahl von Rechenzentren' provides assistance in this regard.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-02.02B", + "Description": "Operational redundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-02 Redundancy Model", + "Type": "Basic", + "AboutCriteria": "Operational redundancy of the sites to each other in the sense of this criterion is given if based on the assessment of elementary risks at the site corresponding distances of the premises and buildings to these risks are maintained. Very extensive events which, due to their extent, could affect several sites of the same redundancy group simultaneously or in a timely manner (e.g. floods, earthquakes) are not considered. There are cloud service providers who no longer address the issue of reliability of the cloud service on a physical level through redundancy from two independent locations, but through resilience. The cloud service is provided simultaneously from more than two locations. The underlying distributed data centre architecture ensures that the failure of a location or components of a location does not violate the defined availability criteria of the cloud service. Such an architecture can represent an alternative fulfilment (cf. Chapter 3.4.8) of the criterion. The tests and exercises on functionality required in the criterion also apply analogously to resilient architectures.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-02.02AS", + "Description": "The georedundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-02 Redundancy Model", + "Type": "Additional (Sharpening)", + "AboutCriteria": "A georedundancy of the sites to each other in the sense of this criterion is given if a very extensive event at a site under no circumstances affects several sites of the same redundancy group simultaneously or promptly. The BSI publication 'Kriterien für die Standortwahl von Rechenzentren' provides assistance in this regard.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-02.03B", + "Description": "The functionality of the redundancy is checked at least annually by suitable tests and exercises (cf. BCM-04).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-02 Redundancy Model", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-03.01B", + "Description": "The structural shell of premises and buildings related to the cloud service provided are physically solid and protected by adequate security measures that meet the security requirements of the cloud service provider (cf. PS-01).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-03.02B", + "Description": "The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Basic", + "AboutCriteria": "Security measures for detecting unauthorised access can be security personnel, video surveillance or burglar alarm systems.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "bigquery_dataset_public_access", + "cloudsql_instance_public_access", + "cloudsql_instance_sqlserver_remote_access_flag", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "kms_key_not_publicly_accessible" + ] + }, + { + "Id": "PS-03.03B", + "Description": "The outer doors, windows and other construction elements exhibit an appropriate security level and withstand a break-in attempt for at least ten minutes.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Basic", + "AboutCriteria": "The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-03.04B", + "Description": "The surrounding wall constructions as well as the locking mechanisms meet the associated requirements.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Basic", + "AboutCriteria": "The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-03.05B", + "Description": "If any construction element on its own does not fully meet the associated requirements, additional security measures are implemented to restore the appropriate security level.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Basic", + "AboutCriteria": "Compensating measures can include additional security layers (e.g. security areas) on the premise, an increased presence of security personnel, video surveillance and anti-burglary systems.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-03.06B", + "Description": "Data centre personnel are trained on how to respond effectively to attempts of unauthorised ingress or egress attempts.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-03.01AC", + "Description": "The security measures installed at the site include permanently present security personnel (at least two individuals), video surveillance and anti-burglary systems.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-03 Perimeter Protection", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-04.01B", + "Description": "Preventive and detective physical access controls in premises and buildings related to the cloud service provided are implemented. They are in accordance with the cloud service provider's security requirements (cf. PS-01) and based on the principles defined in IAM-01 to prevent unauthorised access. They are documented and communicated in a policy or concept in accordance with SP-01 and include the following aspects: - Specified procedure for the granting and revoking of access authorisations (cf. IAM-02) based on the principle of least authorisation ('least-privilege-principle') and as necessary for the performance of tasks ('need-to-know-principle');- Revocation of access authorisations if they have not been used for a period of 2 months. Exceptions are only made for well-founded individual cases and follow a defined exception process according to SP-03;- Authentication with at least one factor for access to any non-public area;- Two-factor authentication for access to areas hosting system components that process cloud service customer data;- Visitors and external personnel are tracked individually by the access control during their work in the premises and buildings, identified as such (e.g. by visible wearing of a visitor pass) and supervised during their stay by employees who authorise or deny their actions, and question them if needed about their actions;- Existence and nature of access logging that enables the cloud service provider, in the sense of an effectiveness audit, to check whether only defined personnel have entered the premises and buildings related to the cloud service provided;- Physical access control derogations in case of emergency, including an analysis procedure after every use of these derogations; and- Measures to identify individuals who are not part of the personnel, incorporating them into the access policy system and defining the conditions, if any, under which they may be granted access to the premises.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-04 Physical Site Access Control", + "Type": "Basic", + "AboutCriteria": "For implementing access control based on the need-to-know-principle, a zoning concept can be deployed with each on-premises area having separate access permissions. If a zoning concept is implemented, each on-premises area should be physically separated with its own access control system. Examples for zoning on-premises can be: - Green zone: Public area, contains no resources that are relevant to the provisioning of the cloud service;- Yellow zone: Private area, contains means for supporting the cloud service such as development, administration and supervision; and- Red zone: Sensitive area for production systems such as the server rooms. Exceptions to the revocation of access authorisations after two months of inactivity are limited to cases where employees with specific roles, such as management positions or supervisors, require only occasional but crucial entry. For all other employees, the revocation of access rights takes place after two months as described in the criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-04.02B", + "Description": "At the entrance of applicable non-public perimeters, the cloud service provider displays a warning concerning the limits and access conditions to the corresponding areas.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-04 Physical Site Access Control", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-04.03B", + "Description": "Physical access controls are supported by an access control system.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-04 Physical Site Access Control", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-05.01B", + "Description": "Premises and buildings related to the cloud service provided are protected from fire, smoke, lightning and unwanted water by structural, technical and organisational measures that meet the security requirements of the cloud service provider (cf. PS-01).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-05 Protection against Threats from Outside and from the Environment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-05.02B", + "Description": "Structural Measures include the following aspects: - Establishment of fire sections with a fire resistance duration of at least 90 minutes for all structural parts, or alternatively, equivalent organisational and technical measures that ensure the same level of protection standard as 90-minutes fire-resistant structural parts or establishment of compensating measures for containing fires and maintaining operational capability;- Effective implementation of measures to protect against lightning and overvoltage damage; and- Effective implementation of measures to protect against flooding and heavy rain, unless critical facilities are located significantly above the highest flood level or the backwater level at the location of the cloud data centre.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-05 Fire Protection", + "Type": "Basic", + "AboutCriteria": "Structural parts are walls, ceilings, floors, doors, windows and other breakthroughs like ventilation flaps, etc. Compensating measures can take into account aspects such as: - Partitioning and layout of fire sections;- Extinguishing systems within the fire sections;- Early and very early fire detection mechanisms;- Arrival time of the fire brigade after the fire alarm was triggered; and- Redundancy of systems and supply facilities within the premise. The location of all critical facilities in relation to the highest historically recorded flood level at the cloud data centre site or the site's backwater level acts as the starting point for considering flood and heavy rain protection measures.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-05.03B", + "Description": "Technical Measures include the following aspects: - Early fire detection with automatic voltage release. The monitored areas are sufficiently fragmented to ensure that the prevention of the spread of incipient fires is proportionate to the maintenance of the availability of the cloud service provided;- Extinguishing system or oxygen reduction; and- Fire alarm system with reporting to the local fire department.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-05 Fire Protection", + "Type": "Basic", + "AboutCriteria": "The monitoring of the environmental parameters is addressed in PS-07. When exceeding the allowed control range, alarm messages are generated and forwarded to the responsible cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-05.04B", + "Description": "Organisational Measures include the following aspects: - Regular fire protection inspections to check compliance with fire protection requirements; and- Regular fire protection exercises.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-05 Fire Protection", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.01B", + "Description": "Measures to prevent the failure of the technical supply facilities required for the operation of system components with which cloud service customer data is processed and to protect equipment holding cloud service customer data, are documented and set up in accordance with the security requirements of the cloud service provider (cf. PS-01) with respect to the following aspects: - Operational redundancy (N+1) in power and cooling supply;- Use of appropriately sized uninterruptible power supplies (UPS) and emergency power supplies (EPS), designed to ensure that all data remains undamaged in the event of a power failure. The functionality of UPS and NEA is checked at least annually by suitable tests and exercises (cf. BCM-04);- Maintenance (servicing, inspection, repair) of the utilities in accordance with the manufacturer's recommendations; and- Protection of power supply and telecommunications lines against interruption, interference, damage and eavesdropping.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities", + "Type": "Basic", + "AboutCriteria": "Measures to prevent the failure of the technical supply facilities are e.g. power supply, cooling, fire-fighting technology, telecommunications, security technology, etc. Cloud service providers can ensure that all data remains undamaged in the event of a power failure by shutting down servers following a defined procedure. Power supply and telecommunications lines can be protected against interruption, interference, damage and eavesdropping by e.g. underground supply via different supply routes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.02B", + "Description": "Uninterruptible Power Supplies (UPS) and Emergency Power Supplies (EPS) are designed to meet the availability requirements defined in the Service Level Agreement.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.03B", + "Description": "The cloud service provider ensures that equipment containing media with data (including cloud service customer data and cloud service derived data) is shared with a third party only if the data (including cloud service customer data and cloud service derived data) stored on it is encrypted in accordance with CRY-05 or has been destroyed beforehand using a secure deletion mechanism.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.04B", + "Description": "The protection of power supply and telecommunications lines is checked regularly, but at least every two years as well as in case of suspected manipulation, by qualified personnel regarding the following aspects: - Traces of violent attempts to open closed distributors;- Up-to-dateness of the documentation within the distributor;- Conformity of the actual wiring and patching with the documentation;- The short-circuits and earthing of unneeded cables are intact; and- Impermissible installations and modifications.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.01AC", + "Description": "The cooling supply is designed in such a way that the permissible operating and environmental parameters are also ensured on at least five consecutive days with the highest outside temperatures measured to date at the three nearest official measurement stations around the locations of the premises and buildings, with a safety margin of 3 K (in relation to the outside temperature). The cloud service provider has previously determined the highest outdoor temperatures measured to date (cf. PS-01).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.02AC", + "Description": "The connection to the telecommunications network is designed with sufficient redundancy so that the failure of a telecommunications network does not impair the security or performance of the cloud service provider.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.03AC", + "Description": "Measures are implemented to ensure that the conditions for installation, maintenance and servicing of the related technical equipment (e.g., electrical power, air conditioning, fire protection) are compatible with the cloud service's availability and security requirements.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-06.04AC", + "Description": "The cloud service provider ensures that the maintenance agreements for equipment used to host the cloud service enables to have security updates installed in timely fashion on this equipment.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-06 Power Supply", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-07.01B", + "Description": "The operating parameters of the technical utilities (cf. PS-06) and the environmental parameters of the premises and buildings related to the cloud service provided are monitored and controlled in accordance with the security requirements of the cloud service provider (cf. PS-01).", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-07 Surveillance of Operational and Environmental Parameters", + "Type": "Basic", + "AboutCriteria": "Operating parameters and environmental parameters of the premises and buildings are, e.g. air temperature and humidity, leakage, smoke.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-07.02B", + "Description": "When the permitted control range is exceeded, the responsible departments at the cloud service provider are automatically informed in order to promptly initiate the necessary measures for return to the control range.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-07 Environmental Monitoring", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PS-08.01B", + "Description": "Based on risk assessment according to OIS-07, security requirements for office environments, including home offices, are documented, communicated and provided in accordance with SP-01. These security requirements encompass various aspects to ensure a safe and secure working environment, including: - Physical access controls, such as key cards and biometric scanners, for office buildings;- Use of screen locks and privacy screens for workstations;- No openly visible confidential data at temporarily unattended workstations;- Disposal of all company documents that are no longer required within the company premise;- Prohibition of the use of third party equipment;- Secure office networks with firewalls and secure WIFI configurations as well as VPN for remote access; and- Secure office premises with alarm systems and surveillance cameras.", + "Attributes": [ + { + "Section": "Physical Security (PS)", + "SubSection": "PS-08 Workplace Security Requirements", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-01.01B", + "Description": "The planning of capacities and resources (personnel and IT resources) follows an established procedure in order to avoid possible capacity bottlenecks.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-01 Capacity Management - Planning", + "Type": "Basic", + "AboutCriteria": "For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit. Capacity bottlenecks are limitations in the cloud service provider’s resources, resulting in disruptions of the cloud service or impacting compliance with contractual agreements and service levels.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the capacity and resource requirements to be covered by the cloud service provider are planned and reflected in the SLA with the cloud service provider. The requirements are reviewed regularly and the adjustment of SLA demanded accordingly." + } + ], + "Checks": [] + }, + { + "Id": "OPS-01.02B", + "Description": "The procedures include forecasting future capacity requirements in order to identify usage trends and manage system overload.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-01 Operational Security", + "Type": "Basic", + "AboutCriteria": "For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-01.03B", + "Description": "Cloud service providers take appropriate measures to ensure that they continue to meet the requirements agreed with cloud service customers for the provision of the cloud service in the event of capacity bottlenecks or outages regarding personnel and IT resources. This applies in particular to those relating to the dedicated use of system components, in accordance with the respective agreements.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-01 Operational Security", + "Type": "Basic", + "AboutCriteria": "For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-01.01AC", + "Description": "The forecasts are considered in accordance with the service level agreement for planning and preparing the provisioning.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-01 Operational Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "For economic reasons, cloud service providers typically strive for a high utilisation of IT resources (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud users (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of IT resources is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-02.01B", + "Description": "Technical and organisational safeguards for the monitoring and provisioning and de-provisioning of cloud services are defined. The cloud service provider ensures that resources are delivered as contractually agreed with the customers. The cloud service provider ensures compliance with the service level agreements.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-02 Capacity Management - Monitoring", + "Type": "Basic", + "AboutCriteria": "Technical and organisational measures typically include: - Use of monitoring tools with alarm function when defined threshold values are exceeded;- Process for correlating events and interface to incident management;- Continuous monitoring of the systems by qualified personnel; and- Redundancies in the IT systems.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the contractual agreements made with the cloud service provider for the provision of resources or services can be monitored. In case of deviations, appropriate controls ensure that the cloud service provider is informed so that the cloud service provider can take appropriate action." + } + ], + "Checks": [] + }, + { + "Id": "OPS-02.02B", + "Description": "Capacity bottlenecks are to be reported to cloud service customers analogous to OPS-24.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-02 Change Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-02.01AC", + "Description": "To monitor capacity and availability managed by the cloud service customer, the relevant information is available to the cloud service customer in a self-service portal.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-02 Change Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-03.01B", + "Description": "Depending on the capabilities of the respective service model, the cloud service customer can control and monitor the allocation of the IT resources assigned to the customer for administration/use in order to avoid overcrowding of resources and to achieve sufficient performance.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-03 Capacity Management - Controlling of Resources", + "Type": "Basic", + "AboutCriteria": "Resources according to the possibilities of the service model are for example: - Computing capacity;- Storage capacity;- Configuration of network properties;- Application Programming Interfaces (APIs); and- Databases. System resource allocation may need to take into account any container-based infrastructure used in the service models.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they manage and monitor the system resources in their area of responsibility." + } + ], + "Checks": [] + }, + { + "Id": "OPS-03.02B", + "Description": "The cloud service provider informs the cloud service customer about significant security changes in the allocated IT resources and the planned significant security changes.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-03 Capacity Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-04.01B", + "Description": "Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components under the responsibility of the cloud service provider that are used to provide the cloud service in the production environment;- Operation of protection programmes for employees' terminal equipment; and- Operation of protection programmes on all the incoming flows, including those over cloud service provider end-devices.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-04 Protection Against Malware - Concept", + "Type": "Basic", + "AboutCriteria": "Protection programmes for employee devices can be, for example, server-based protection programmes that scan files in attachments on the server or filter network traffic.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-05.01B", + "Description": "System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Protection Against Malware - Implementation", + "Type": "Basic", + "AboutCriteria": "Protection against malicious programmes can be implemented by operating system-specific protection mechanisms or explicit protection programmes (e.g. for signature- and behaviour-based detection and removal of malicious programmes). If the cloud provider operates malware protected containers or virtual machines to provide the cloud service, the malware protection should include container-specific measures. This can include, for example, monitoring the container images and the container runtime, and due to the frequent start and stop of the containers, real-time scans and -monitoring processes.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the layers of the cloud service which they are responsible for have security products in place to detect and remove malware." + } + ], + "Checks": [] + }, + { + "Id": "OPS-05.02B", + "Description": "If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Logging and Monitoring", + "Type": "Basic", + "AboutCriteria": "Protection against malicious programmes can be implemented by operating system-specific protection mechanisms or explicit protection programmes (e.g. for signature- and behaviour-based detection and removal of malicious programmes). If the cloud provider operates malware protected containers or virtual machines to provide the cloud service, the malware protection should include container-specific measures. This can include, for example, monitoring the container images and the container runtime, and due to the frequent start and stop of the containers, real-time scans and -monitoring processes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-05.01AS", + "Description": "If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Logging and Monitoring", + "Type": "Additional (Sharpening)", + "AboutCriteria": "Protection against malicious programmes can be implemented by operating system-specific protection mechanisms or explicit protection programmes (e.g. for signature- and behaviour-based detection and removal of malicious programmes). If the cloud provider operates malware protected containers or virtual machines to provide the cloud service, the malware protection should include container-specific measures. This can include, for example, monitoring the container images and the container runtime, and due to the frequent start and stop of the containers, real-time scans and -monitoring processes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-05.01AC", + "Description": "The cloud service provider creates regular reports on the checks performed by the operated protection programs, which are reviewed and analysed by authorised bodies or committees.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Logging and Monitoring", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-05.02AC", + "Description": "Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Logging and Monitoring", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_account_access_approval_enabled", + "iam_no_service_roles_at_project_level", + "iam_sa_no_user_managed_keys", + "iam_sa_user_managed_key_unused", + "iam_service_account_unused", + "iam_sa_no_administrative_privileges" + ] + }, + { + "Id": "OPS-05.03AC", + "Description": "The configuration of the protection mechanisms is monitored automatically.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Logging and Monitoring", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OPS-05.04AC", + "Description": "Deviations from the specifications are automatically reported to the cloud service provider's subject matter experts so that they can be immediately assessed and the necessary measures taken.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-05 Logging and Monitoring", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OPS-06.01B", + "Description": "Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the following aspects. - The extent and frequency of data backups and the duration of data retention are consistent with the contractual agreements with the cloud service customers and the cloud service provider's operational continuity requirements for Recovery Time Objective (RTO) and Recovery Point Objective (RPO);- Data is backed up in encrypted, state-of-the-art form;- Secure storage, transfer, management and disposal of backup data;- Access to the backed-up data and the execution of restores is performed only by authorised persons;- Tests of data restore procedures by the cloud service provider (cf. OPS-08); and- If part of the contractual agreement: Execution of actual data restore requests or restore tests initiated by the cloud service customer.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-06 Data Backup and Recovery - Concept", + "Type": "Basic", + "AboutCriteria": "If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.The data backup concept specifies which type of data backup is to be carried out (e.g. scope, frequency and duration) and specifies which data shall also be backed up in special cases (e.g. pure use of compute nodes without data storage). When backing up data, one has to distinct between *backups* and *snapshots* of virtual machines. Snapshots do not replace backups but can be part of the backup strategy to achieve Recovery Point Objectives (RPO) if they are additionally stored outside the original data location. The business requirements of the cloud service provider for the scope, frequency and duration of the data backup result from the business impact analysis (cf. BCM-02) for development and operational processes of the cloud service. If different data backup and recovery procedures exist for cloud service customer data and cloud service provider data, both variants should be in scope for tests of controls according to this criteria catalogue. Existing contractual agreements prior to a C5 attestation do not need to be updated to incorporate the requirements specified in this criterion. Instead, new contractual agreements should be designed to ensure that specified requirements are clearly defined and agreed upon with cloud service customers.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the contractual agreements made with the cloud service provider regarding the scope, frequency and duration of data retention meet business requirements. The business requirements are assessed as part of the business impact analysis (cf. BCM-02)." + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "OPS-07.01B", + "Description": "The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and instructions defined in OPS-06.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-07 Data Backup and Recovery - Monitoring", + "Type": "Basic", + "AboutCriteria": "If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the backup of data within their area of responsibility is monitored by technical and organisational measures." + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "OPS-07.02B", + "Description": "Malfunctions are investigated by qualified staff and rectified promptly to ensure compliance with contractual obligations to cloud service customers or the cloud service provider's business requirements regarding the scope and frequency of data backup and the duration of storage.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-07 Security Testing", + "Type": "Basic", + "AboutCriteria": "If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-07.01AC", + "Description": "The relevant logs or summarised results are available to the cloud service customer in a self-service portal for monitoring the data backup.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-07 Security Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-08.01B", + "Description": "Restore procedures are tested regularly, at least annually. The tests include cloud service customer data, cloud service derived data and cloud service provider data in accordance with the contractual agreements.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Data Backup and Recovery - Regular Testing", + "Type": "Basic", + "AboutCriteria": "The use of cloud service customer data in backup and restore procedures as described in the basic criterion is a carefully considered exception. This exception does not extend to general software development or other testing environments and the use of cloud service customer data for testing is restricted specifically to backup and restore procedures.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they actively request information on the results of recovery tests from the cloud service provider. Customers assess the effectiveness of applied data recovery strategies and integrate insights into their own emergency plans in alignment with their business needs and security standards." + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "OPS-08.02B", + "Description": "The tests allow an assessment as to whether the contractual agreements as well as the specifications for the maximum tolerable downtime (Recovery Time Objective, RTO) and the maximum permissible data loss (Recovery Point Objective, RPO) are adhered to (cf. BCM-02).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-08.03B", + "Description": "Cloud service customer data is only restored in environments that are subject to the same access restrictions as the production environment.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Basic", + "AboutCriteria": "If cloud service customer data is restored in an environment with differing access restrictions, the confidentiality of the data may be affected.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "OPS-08.04B", + "Description": "The cloud service provider thoroughly documents restore tests, including the safe disposal of restored data.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-08.05B", + "Description": "Deviations from the specifications are reported to the responsible personnel or system components so that these can promptly assess the deviations and initiate the necessary actions.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-08.06B", + "Description": "If the data backup is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider shall present this situation transparently in the system description.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-08.01AC", + "Description": "At the customer's request, the cloud service provider informs the cloud service customer of the results of the recovery tests.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-08.02AC", + "Description": "Recovery tests are included in the cloud service provider's business continuity management.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-08 Incident Response", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-09.01B", + "Description": "The cloud service provider transfers cloud service provider data and, if contractually agreed upon, cloud service customer data and cloud service derived data to be backed up to a remote location or transports these on backup media to a remote location.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-09 Data Backup and Recovery - Storage", + "Type": "Basic", + "AboutCriteria": "A remote location can be e.g. another data centre of the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-09.02B", + "Description": "The data classification of the original data is applied to backups.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-09 Business Continuity", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "OPS-09.03B", + "Description": "If the data backup is transmitted to the remote location via a network, the data backup or the transmission of the data takes place in an encrypted form that corresponds to the state-of-the-art.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-09 Business Continuity", + "Type": "Basic", + "AboutCriteria": "A remote location can be e.g. another data centre of the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-09.04B", + "Description": "The distance to the main site is chosen after sufficient consideration of the factors recovery times and impact of disasters on both sites.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-09 Business Continuity", + "Type": "Basic", + "AboutCriteria": "A remote location can be e.g. another data centre of the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-09.05B", + "Description": "The physical and environmental security measures at the remote site are at the same level as at the main site.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-09 Business Continuity", + "Type": "Basic", + "AboutCriteria": "A remote location can be e.g. another data centre of the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-09.06B", + "Description": "If the data backup is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider shall present this situation transparently in the system description.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-09 Business Continuity", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-10.01B", + "Description": "The cloud service provider has established policies and instructions that govern the logging and monitoring of events on system components within its area of responsibility. These policies and instructions are documented, communicated and provided according to SP-01 with respect to the following aspects: - Definition of events that could lead to a violation of the protection goals;- Specifications for activating, stopping and pausing the various logs;- Information regarding the purpose and retention period of the logs.- Define roles, responsibilities and authorities for setting up and monitoring logging;- Definition of log data that may be transferred to cloud service customers and technical requirements of such log forwarding;- Information about timestamps in event creation;- Time synchronisation of system components with one or more approved time sources that are consistent with each other and that the cloud service provider considers to be reliable based on defined criteria. These sources can themselves be synchronised to several external reliable sources, except for isolated networks; and- Compliance with legal and regulatory frameworks.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-10 Logging and Monitoring - Concept", + "Type": "Basic", + "AboutCriteria": "Logs as referred to in the basic criterion include cloud service derived data and cloud service provider data.Legal and regulatory frameworks can define e.g. legal requirements for retention and deletion of data.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that appropriate logging and monitoring of events that may affect the security and availability of the cloud service (e.g. administrator activities, system failures, authentication checks, data deletions, etc.) takes place for those layers of the cloud service under their responsibility." + } + ], + "Checks": [] + }, + { + "Id": "OPS-11.01B", + "Description": "Policies and instructions for the secure handling of cloud service derived data and account data are documented, communicated and provided according to SP-01 with regard to the following aspects: - Cloud service derived data and account data is collected and used solely to administer and operate the cloud service, including purposes related to the implementation of security controls;- Protection in confidentiality and integrity of the logs;- As far as technically possible, anonymised cloud service derived data is used only in a way so that no conclusions can be drawn about the usage behaviour of individual users of the cloud service customer;- No commercial use beyond the aforementioned purpose to administer and operate the cloud service;- Storage for a fixed period reasonably related to the purposes of the collection;- Cloud service derived data that has been fully anonymised and cannot be traced back to individual cloud service customers may be further processed and retained, provided no contractual or legal restrictions exist, otherwise immediate deletion if the purposes of the collection are fulfilled and further storage is no longer necessary; and- Provision to cloud service customers according to contractual agreements.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-11 Logging and Monitoring Management Concept for Cloud Service Derived Data and Account Data", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that their contracts with the cloud service provider clearly outline the permissible uses of cloud service derived data. Cloud service customers verify that such data processing complies with contractual or legal restrictions and understand that the provider is obligated to delete data when it is no longer necessary for its initial purposes, unless agreed otherwise." + } + ], + "Checks": [] + }, + { + "Id": "OPS-11.02B", + "Description": "The cloud service provider lists in the contractual agreements with the cloud service customers all purposes for the collection and use of cloud service derived data that are not related to the universal requirements that apply inherently to all cloud services.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-11 Configuration Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-11.01AC", + "Description": "Personal data is automatically removed from the log data before the cloud service provider processes it, as far as technically possible. The removal is done in a way that allows the cloud service provider to continue to use the log data for the purpose for which it was collected.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-11 Configuration Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-11.02AC", + "Description": "Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-11 Configuration Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-12.01B", + "Description": "The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and systems;- Retention for the specified period; and- Deletion when further retention is no longer necessary for the purpose of collection.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-12 Logging and Monitoring - Access, Storage and Deletion", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-13.01B", + "Description": "The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-13 Security Information and Event Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-13.02B", + "Description": "The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential threats;- Real-time alerting to inform the incident response team of critical events;- Reporting to the incident response team in case new information relevant to an event becomes available; and- Automated response mechanisms for addressing security incidents.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-13 Network Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-13.03B", + "Description": "The cloud service provider protects all SIEM logs to avoid tampering and deletion.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-13 Network Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-13.01AC", + "Description": "The cloud service provider validates that event detection processes operate as intended on appropriate assets as identified in the asset classification schema (cf. AM-09).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-13 Network Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OPS-13.02AC", + "Description": "Any deviations identified during validation are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-13 Network Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-13.03AC", + "Description": "Issued events which can lead to security incidents trigger incident handling activities by the cloud service provider without undue delay.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-13 Network Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OPS-14.01B", + "Description": "The cloud service provider retains the generated log data and keeps it in an appropriate, unchangeable and aggregated form, regardless of the source of such data, so that a central, authorised evaluation of the data is possible.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-14 Logging and Monitoring - Storage of the Logging Data", + "Type": "Basic", + "AboutCriteria": "Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they actively request the customer-specific portion of the cloud service derived data that consists of log data, if required." + } + ], + "Checks": [] + }, + { + "Id": "OPS-14.02B", + "Description": "Log data is deleted if it is no longer required for the purpose for which it was collected.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-14 Data Protection", + "Type": "Basic", + "AboutCriteria": "Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ] + }, + { + "Id": "OPS-14.03B", + "Description": "Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state-of-the-art encryption or a dedicated administration network (out-of-band management).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-14 Data Protection", + "Type": "Basic", + "AboutCriteria": "Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-14.01AC", + "Description": "Depending on the protection requirements of the cloud service provider and the technical feasibility, log data and cloud service customer data is logically or physically separated.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-14 Data Protection", + "Type": "Additional (Complementing)", + "AboutCriteria": "Log' refers to a document used to record and describe or denote selected items identified during execution of a process or activity. Log data includes both cloud service derived data and cloud service provider data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-15.01B", + "Description": "The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-15 Logging and Monitoring - Accountability", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that unique user IDs are assigned which allow a corresponding analysis in the event of an incident." + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled" + ] + }, + { + "Id": "OPS-15.02B", + "Description": "Each logged event shall include a time/date stamp to ensure accurate and traceable records.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-15 Access Control", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled" + ] + }, + { + "Id": "OPS-15.03B", + "Description": "The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-15 Access Control", + "Type": "Basic", + "AboutCriteria": "Infrastructure components within the meaning of this criterion are e.g. fabric controllers, network components and virtualisation servers.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-15.01AC", + "Description": "On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-15 Access Control", + "Type": "Additional (Complementing)", + "AboutCriteria": "The additional criterion also refers to logs of system components under responsibility of the cloud service provider, to which the cloud service customer generally has no access, insofar as these logs are relevant for the analysis of security incidents and for identifying access to cloud service customer service data (cf. IAM-07 and INQ-04). For logging of system components under responsibility of the cloud service provider cf. PSS-04.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_sink_created" + ] + }, + { + "Id": "OPS-15.02AC", + "Description": "Such logs are collected in a way that allows their use as credible evidence. This includes: - Records are complete and have not been tampered with in any way;- Logging systems are clock synchronised, logs include accurate timestamps;- Copies of electronic evidence are provably identical to the originals; and- Any information system from which evidence has been gathered was operating correctly at the time the evidence was recorded.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-15 Access Control", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_sink_created" + ] + }, + { + "Id": "OPS-16.01B", + "Description": "Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-16 Logging and Monitoring - Configuration", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-16.02B", + "Description": "Changes to the configuration are made in accordance with the applicable policies (cf. DEV-03).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-16 Security Monitoring", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-17.01B", + "Description": "The cloud service provider monitors the availability of the system components for logging and monitoring in its area of responsibility.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-17 Logging and Monitoring - Availability of the Monitoring Software", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-17.02B", + "Description": "Failures are automatically and promptly reported to the cloud service provider's responsible departments so that these can assess the failures and take required action.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-17 Security Operations", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag" + ] + }, + { + "Id": "OPS-17.01AC", + "Description": "The system components for logging and monitoring are designed in such a way that the overall functionality is not restricted if individual components fail.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-17 Security Operations", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-17.02AC", + "Description": "The cloud service provider defines, documents and implements measures to protect the integrity, availability and confidentiality of the logs and the associated infrastructure.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-17 Security Operations", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-18.01B", + "Description": "Guidelines and instructions with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure the timely identification and addressing of vulnerabilities in the system components used to provide the cloud service. These guidelines and instructions contain specifications regarding the following aspects: - Regular (proactive) identification of vulnerabilities through suitable measures, including vulnerability scans and penetration tests, considering typical vulnerability classes and Common Weaknesses (CWEs);- Assessing the severity of identified vulnerabilities using the Common Vulnerability Scoring System (CVSS);- Prioritising and implementing measures considering existing standards for timely remediation and/or mitigation of identified vulnerabilities based on severity according to defined timeframes and with reference to commonly used scoring systems like the Exploit Prediction Scoring System (EPSS) and the Stakeholder-Specific Vulnerability Categorisation (SSVC);- Deployment of Security Patches;- Handling system components for which no measures for timely remediation or mitigation of vulnerabilities are initiated based on a risk assessment;- Interfaces to incident management in case vulnerabilites become incidents;- If AI-based tools are used for performing vulnerability scans or penetration tests, requirements for the comprehensible (traceable, transparent) documentation on the use of such tools and that these tools shall be used to support the cloud service provider's subject matter experts, not to replace them; and- Providing information on the configuration of system components and cloud services, the existing vulnerabilities, and the available patches and/or mitigation measures, using widely adopted, preferably automated, formats.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-18 Managing Vulnerabilities - Concept", + "Type": "Basic", + "AboutCriteria": "Suitable measures for the identification of vulnerabilities include implementing RFC 9116 in conjunction with a Coordinated Vulnerability Disclosure (CVD) Policy according to established guidelines like ISO/IEC TR 5895:2022 and ISO/IEC 29147:2018 and community standards like Google's Project Zero Vulnerability Disclosure Policy. The Common Vulnerability Scoring System (CVSS) is a technical standard that can be used for assessing the severity of identified vulnerabilities. Scores are calculated based on a formula with several metrics that approximate ease and impact of an exploit. In CVSS version 4.0 the scores can be mapped to qualitative ratings as follows: - Low: 0.1 - 3.9;- Medium: 4.0 - 6.9;- High: 7.0 - 8.9; and- Critical: 9.0 - 10.0. Widely adopted formats on the configuration of system components and cloud services, the existing vulnerabilities, and the available patches and/or mitigation measures include: - Software Bill of Materials (SBOM),- Common Vulnerabilities and Exposures (CVE) or European Vulnerability Database (EUVD),- Vulnerability, Exploitability eXchange (VEX), and- Common Security Advisory Frameworks (CSAF). ISO/IEC 30111:2019 provides requirements and recommendations for prioritising and implementing measures to ensure the timely remediation or mitigation of identified vulnerabilities.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they check system components in their area of responsibility for vulnerabilities on a regular basis and mitigate these with appropriate measures." + } + ], + "Checks": [] + }, + { + "Id": "OPS-18.02B", + "Description": "The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-18 Security Governance", + "Type": "Basic", + "AboutCriteria": "ISO/IEC 30111:2019 provides requirements and recommendations for prioritising and implementing measures to ensure the timely remediation or mitigation of identified vulnerabilities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-18.03B", + "Description": "The cloud service provider also mandates in its policies and procedures that for 'high' vulnerabilities, engagement is to begin within one working day after identification, with regular follow-up of the vulnerability until it has been remediated.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-18 Security Governance", + "Type": "Basic", + "AboutCriteria": "ISO/IEC 30111:2019 provides requirements and recommendations for prioritising and implementing measures to ensure the timely remediation or mitigation of identified vulnerabilities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-18.04B", + "Description": "Based on a risk-assessment (cf. OIS-07), the cloud service provider can decide not to remediate or mitigate identified vulnerabilities. Such a risk-assessment and the compensating or mitigating measures are regularily reviewed.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-18 Security Governance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-19.01B", + "Description": "Guidelines and instructions with technical and organisational measures are documented, communicated, and provided in accordance with SP-01 to ensure the timely identification and management of incidents and crashes in the system components used to provide the cloud service or of parts or the whole cloud service. These guidelines and instructions include specifications regarding the following aspects: - Classification and prioritisation of incidents and crashes;- Incident models for addressing known issues;- Escalation rules and procedures, including criteria for triggering Security Incident Management (SIM) processes in accordance with SIM-02 or internal incident management procedures;- Knowledge sources for incidents and crashes;- Criteria for determining when crashes are classified as incidents and when they trigger incident management processes;- Mechanisms ensuring that access to crash files is restricted to authorised personnel only;- Safeguards to prevent exposure of sensitive, personal, or confidential data within crash files;- Encryption of crash files for storage and during transmission;- Access management, logging, and review processes for access logs of crash files; and- Retention periods and secure deletion processes for crash files once no longer needed.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-19 Managing Incidents and Crashes - Concept", + "Type": "Basic", + "AboutCriteria": "A crash is a sudden and complete failure of a system or system component. A crash file is the dump of a system's execution state, usually including contents of its storage or registers at the time of the crash (e.g. memory dump).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-20.01B", + "Description": "The cloud service provider identifies, records, classifies, and prioritises incidents according to the policies and instructions.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-20 Managing Incidents - Implementation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-21.01B", + "Description": "Crashes of system components, parts of or the whole cloud service under the responsibility of the cloud service provider are identified, recorded, and addressed according to the policies and instructions.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-21 Managing Crashes - Implementation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.01B", + "Description": "The cloud service provider performs penetration tests by qualified internal personnel or external penetration testers at least once a year and in case of significant changes to the cloud service.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service. The qualification and competence of personnel for penetration tests can be verified based on professional certifications, e.g. as BSI-certified IS penetration tester or CREST-certified Cyber Security Professional.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.01AS", + "Description": "The cloud service provider performs penetration tests at least every six months and in case of significant changes to the cloud service by independent external penetration testers. The external penetration testers are engaged only if the personnel supposed to perform the test verifiably meets the cloud service provider's qualification and competence requirements. Internal personnel for penetration tests may support the external personnel.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Additional (Sharpening)", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service. The qualification and competence of personnel for penetration tests can be verified based on professional certifications, e.g. as BSI-certified IS penetration tester or CREST-certified Cyber Security Professional.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.02B", + "Description": "Penetration tests are carried out in accordance with a documented concept for penetration tests that outlines the types of penetration tests to be performed and the requirements for the qualification and competence of the personnel to perform such tests.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.02AS", + "Description": "Pre-launch and post-launch penetration tests are performed in accordance with a documented concept for penetration tests that outlines the types of penetration tests to be performed and the requirements for the qualification and competence of the personnel to perform such tests.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Additional (Sharpening)", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.03B", + "Description": "Penetration tests target the system components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider. System components to be targeted are identified in a risk assessment.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service. System components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider can comprise such system components that are exposed at the external perimeter of the network or components accessible only from inside the network.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.04B", + "Description": "Penetration tests are carried out in accordance with test plans that cover all relevant system components and specify which system components are to be tested.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.05B", + "Description": "If penetration tests follow multi-annual test plans, all relevant system components are subjected to at least one penetration test within a maximum period of three years.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service. System components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider can comprise such system components that are exposed at the external perimeter of the network or components accessible only from inside the network.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.06B", + "Description": "The cloud service provider assesses the severity of identified vulnerabilities in accordance with the Common Vulnerability Scoring System (CVSS), in the latest version valid at the time of the execution of the control.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.07B", + "Description": "The cloud service provider discloses identified vulnerabilities in the online register for known vulnerabilities in accordance with criterion PSS-03.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.08B", + "Description": "Actions for remediation or mitigation are taken in accordance with the time frames as defined in the concept for managing vulnerabilities (cf. OPS-18).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.09B", + "Description": "The cloud service provider performs a root cause analysis on the vulnerabilities discovered through penetration testing in order to assess to which extent similar vulnerabilities may be present in the cloud service. The cloud service provider correlates the possible exploits of discovered vulnerabilities with previous information security incidents to identify if the vulnerability may have been exploited before its discovery.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Basic", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.01AC", + "Description": "Penetration tests are performed based on reviews of the architecture and configuration of the system components, and of the cloud service provider's source code.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.02AC", + "Description": "The cloud service provider plans penetration testing in a multi-annual work programme.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-22.03AC", + "Description": "The cloud service provider reviews the performance of penetration tests on system components at least annually, and in case of significant changes to the cloud service.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-22 Security Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "See section '1.2 Definitions' for the term penetration test.There are three types of penetration tests: - Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested. It can further be distinguished between - Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-23.01B", + "Description": "The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-23 Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures", + "Type": "Basic", + "AboutCriteria": "The assessment of the suitability, appropriateness and effectiveness of procedures for managing vulnerabilities and incidents may be based on the following information: 1. Regular reporting of KPIs that are volume, time-based or resolution/quality-based, e.g.a. for vulnerabilities:- Mean Time to Detect (MTTD, average time it takes to discover a vulnerability from its disclosure or creation);- Mean Time to Remediate (MTTR, average time it takes to fix or patch a vulnerability after it has been detected);- Number of open vulnerabilities at each severity level; and- Percentage of vulnerabilities that have been patched within a set period.b. for incidents:- Number of incidents reported over a set period and how this evolved over the time;- Average response and resolution time;- Percentage of incidents resolved within the agreed-upon service level agreement; and- Percentage of incidents resolved during the first attempt for resolution.2. Customer complaints or the results of customer surveys about their satisfaction with the procedures; and3. Results of internal or external audits.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-23.02B", + "Description": "Results are evaluated at least quarterly in a documented form by responsible individuals or groups of the cloud service provider to initiate continuous improvement actions and to verify their effectiveness.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-23 Security Training", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-24.01B", + "Description": "The cloud service provider periodically informs the cloud service customer on the status of incidents affecting the cloud service customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-24 Involvement of Cloud Service Customers in the Event of Incidents", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they receive notifications from the cloud service provider regarding incidents that affect them, and that these notifications are forwarded in a timely manner to the department responsible for processing them so that appropriate action can be taken." + } + ], + "Checks": [ + "iam_organization_essential_contacts_configured" + ] + }, + { + "Id": "OPS-24.02B", + "Description": "As soon as an incident has been resolved from the cloud service provider's perspective, the cloud service customer is informed about the actions taken according to the contractual agreements.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-24 Security Awareness", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_organization_essential_contacts_configured" + ] + }, + { + "Id": "OPS-24.03B", + "Description": "Capacity bottlenecks are to be communicated to cloud service customers in a similar manner.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-24 Security Awareness", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-24.01AC", + "Description": "The cloud service provider defines and documents procedures in contractual agreements with cloud service customers that specify the involvement of the customer in confirming, within a specified time period, that a resolution has effectively addressed the root cause of an incident.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-24 Security Awareness", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-25.01B", + "Description": "System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a comparison of the Software Bill of Materials (SBOM) data against up-to-date vulnerability databases (e.g., CVE, EUVD, etc.) to identify known vulnerabilities.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-25 Managing Vulnerabilities, Malfunctions and Errors - Vulnerability Scans", + "Type": "Basic", + "AboutCriteria": "In contrast to penetration tests (cf. OPS-22), which are carried out manually and according to an individual scheme, the check for open vulnerabilities is performed automatically, using so-called vulnerability scanners.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures. If cloud service customers operate virtual machines or containers with the cloud service, this also includes performing vulnerability scans to ensure that secure images (so-called golden images) are used." + } + ], + "Checks": [ + "gcr_container_scanning_enabled", + "artifacts_container_analysis_enabled" + ] + }, + { + "Id": "OPS-25.02B", + "Description": "The cloud service provider assesses the severity of vulnerabilities in accordance with defined criteria.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-25 Security Documentation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-25.01AS", + "Description": "The cloud service provider assesses the severity of vulnerabilities using the latest version of the Common Vulnerability Scoring System (CVSS) valid at the time of the execution of the control.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-25 Security Documentation", + "Type": "Additional (Sharpening)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-25.03B", + "Description": "Measures for timely remediation or mitigation are initiated within defined time windows.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-25 Security Documentation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-25.01AC", + "Description": "Time frames for the initiation of remediation or mitigation efforts after a vulnerability is identified are defined and monitored according to a risk-based classification framework. This framework incorporates, but is not limited to, the CVSS severity level of vulnerabilities.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-25 Security Documentation", + "Type": "Additional (Complementing)", + "AboutCriteria": "An example of a framework for risk-based classification and definition of timeframes can be: - Critical (CVSS = 9.0 - 10.0): 3 hour- High (CVSS = 7.0 - 8.9): 8 hours- Medium (CVSS = 4.0 - 6.9): 5 days- Low (CVSS = 0.1 - 3.9): 1 month", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-26.01B", + "Description": "System components in the production environment used to provide the cloud service under the cloud service provider's responsibility are hardened according to generally accepted industry standards.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Managing Vulnerabilities, Malfunctions and Errors - System Hardening", + "Type": "Basic", + "AboutCriteria": "System components in the sense of the criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that layers of the cloud service which are under their responsibility are hardened according to generally established and accepted industry standards. The hardening specifications applied are derived from a risk assessment of the planned usage of the cloud service." + } + ], + "Checks": [] + }, + { + "Id": "OPS-26.02B", + "Description": "The hardening requirements for each system component are documented.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Security Reporting", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-26.03B", + "Description": "If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Security Reporting", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-26.04B", + "Description": "Configurations and log files (cloud service provider data) regarding the continuous availability of the images are retained.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Security Reporting", + "Type": "Basic", + "AboutCriteria": "The configuration and log files for non-modifiable mages include e.g.: - Configuration of the images used with regards to implemented hardening; and specifications including version history; and- Logs for file integrity monitoring of images in productive use. Generally accepted industry standards are, for example, the Security Configuration Benchmark of the Centre for Internet Security (CIS) or the corresponding modules in the BSI IT-Grundschutz-Compendium.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-26.05B", + "Description": "The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Security Reporting", + "Type": "Basic", + "AboutCriteria": "System components in the sense of the criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events. Compliance with hardening specifications can be monitored with e.g. file integrity monitoring.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-26.01AS", + "Description": "System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Security Reporting", + "Type": "Additional (Sharpening)", + "AboutCriteria": "System components in the sense of the criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the cloud service provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events. Compliance with hardening specifications can be monitored with e.g. file integrity monitoring.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "OPS-26.06B", + "Description": "Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-26 Security Reporting", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "OPS-27.01B", + "Description": "The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known vulnerabilities in third party or open-source libraries used within applications;- Evaluating the potential impact of identified updates and vulnerabilities on the applications and the overall security posture;- Implementing necessary updates and patches in a timely manner to address identified vulnerabilities; and- Continuously monitoring applications to ensure updates are effectively applied and no new vulnerabilities are introduced.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-27 Managing Vulnerabilities, Malfunctions and Errors - Externally Sourced Components", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-28.01B", + "Description": "Based on a risk-assessment (cf. OIS-07), the cloud service provider established guidelines and instructions with technical and organisational measures to ensure separation of cloud service customer data between different customers and between customers and the cloud service provider. These guidelines and instructions are documented, communicated and provided in accordance with SP-01 and contain specifications regarding the client separation based on a documented cloud layer model (cf. OPS-29) and include the following: - Illustration of which cloud layers are used for the particular cloud service. The used cloud layers should be appropriate to enable client separation;- Measures used to separate cloud service customer data along the used cloud layers. Those measures are categorised according to the protection goals of confidentiality, integrity and availability and if they are preventive, detective or reactive measures;- Monitoring and compliance with these measures; and- Initiation of suitable measures in the event of deviations.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-28 Separation of Datasets - Guideline", + "Type": "Basic", + "AboutCriteria": "The guidelines and instructions of this criteria are meant to serve as an umbrella guideline for all cyber security measures against all threats that stem from sharing physical or virtual ressources and that lead to a loss of separation of data sets. Ideally, the cloud service provider has already ensured the separation of data sets between different customers and between customers and cloud service provider via all other guidelines, instructions and the corresponding measures. The systematic approach of the guidelines and instructions addressed by this criterion ensures that no aspect of this separation is overlooked. It also provides a good basis to explain the cyber security of the cloud service to the customer in an appealing manner (cf. PSS-01). Cloud layers in the sense of this criterion can be found in the *CISA Cloud Security Technical Reverence Architecture*. The cloud service provider may use its own categorisation of cloud layers. There are nine combinations for confidentiality, integrity and availability with prevention, detection and reaction. Applying this to every cloud layer may lead to a large number of combinations. However, depending on the cloud service, it can be acceptable that it may not be possible to provide meaningful information in the guideline for every possible combination of prevention, detection and reaction as well as confidentiality, integrity and availability. Those cases should be comprehensibly documented in the guidelines and instructions.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-29.01B", + "Description": "Based on a risk-assessment (cf. OIS-07), the requirements for separating cloud service customer data between different customers and between customers and cloud service provider on shared virtual or shared ressources along the cloud layers, the cloud service provider implements measures and procedures against threats to the separation of data sets according to the guidelines and instructions of OPS-28. The measures address prevention against, detection of and reaction to any incidents infringing the separation.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-29 Separation of Datasets - Implementation", + "Type": "Basic", + "AboutCriteria": "The guidelines and instructions of this criteria are meant to serve as an umbrella guideline for all cyber security measures against all threats that stem from sharing physical or virtual ressources and that lead to a loss of separation of data sets. Ideally, the cloud service provider has already ensured the separation of data sets between different customers and between customers and cloud service provider via all other guidelines, instructions and the corresponding measures. The systematic approach of the guidelines and instructions addressed by this criterion ensures that no aspect of this separation is overlooked. It also provides a good basis to explain the cyber security of the cloud service to the customer in an appealing manner (cf. PSS-01).", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the functions provided by the cloud service for segregating shared virtual and physical resources are used in such way that risks related to segregation are adequately addressed according to the data's protection requirements." + } + ], + "Checks": [] + }, + { + "Id": "OPS-29.02B", + "Description": "Cloud service customer data stored and processed on shared virtual and physical resources is securely and strictly separated according to a documented approach based on OIS-07 risk analysis and following policies on cryptography (cf. CRY-01) to ensure the confidentiality and integrity of this data.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-29 Security Audits", + "Type": "Basic", + "AboutCriteria": "Shared resources include memory, cores and storage networks. The separation of cloud service customer data on shared resources can take place, for example, in accordance with cloud layers described in the CISA Cloud Security TRA. Where the adequacy and effectiveness of segregation cannot be assessed with reasonable assurance (e.g. due to complex implementation), evidence may also be provided through expert third party review results (e.g. penetration tests to validate the concept). The separation of transmitted data is subject to criterion COS-06.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-29.03B", + "Description": "The measures are regularily reviewed and improved accordingly.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-29 Security Audits", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-30.01B", + "Description": "If the cloud service comprises capabilities for confidential computing, policies and instructions with technical and organisational safeguards are documented, communicated and provided according to SP-01, in which the following aspects are described: - Purpose and scope, including which information security risks are to be mitigated through the use of confidential computing (cf. OIS-07);- Available confidential computing technologies;- Determination of which parts of the cloud stack are protected with each technology and where third party access is possible;- Listing of involved suppliers/service organisations; and- Utilisation of Trusted Execution Environments (TEEs) or secure enclaves.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-30 Confidential Computing - Policies and Instructions", + "Type": "Basic", + "AboutCriteria": "Confidential Computing within the meaning of this criterion uses hardware-based, attested TEEs to protect the confidentiality and integrity of data during processing ('in use'). A TEE represents an isolated part within a system that provides a specially protected runtime environment. The TEE can be part of the main processor (CPU) or part of the system-on-chip (SoC). Only authorised entities are allowed to introduce or modify applications or code within the TEE. The attestation of the TEE and the application running within the TEE serves to validate the trustworthiness of the processing.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-30.02B", + "Description": "The cloud service provider provides its customers with information on the above listed aspects according to PSS-01.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-30 Security Controls", + "Type": "Basic", + "AboutCriteria": "Confidential Computing within the meaning of this criterion uses hardware-based, attested TEEs to protect the confidentiality and integrity of data during processing ('in use'). A TEE represents an isolated part within a system that provides a specially protected runtime environment. The TEE can be part of the main processor (CPU) or part of the system-on-chip (SoC). Only authorised entities are allowed to introduce or modify applications or code within the TEE. The attestation of the TEE and the application running within the TEE serves to validate the trustworthiness of the processing.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-30.03B", + "Description": "Additional aspects addressed by the policies and instructions for confidential computing, not necessarily included in the information provided to the cloud service customers, include: - Responsibilities for the implementation and monitoring of Confidential Computing measures;- Security requirements to ensure the confidentiality, integrity, and authenticity of the data during processing, including that (a) neither the cloud service provider nor any other unauthorised entity shall be able to access the cloud service customer data or the keys used for protecting that data, and (b) use of cryptographic algorithms that comply with the cloud service provider's policy for the use of cryptographic mechanisms (cf. CRY-01); and- Relevant legal and regulatory requirements applicable to confidential computing.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-30 Security Controls", + "Type": "Basic", + "AboutCriteria": "Confidential Computing within the meaning of this criterion uses hardware-based, attested TEEs to protect the confidentiality and integrity of data during processing ('in use'). A TEE represents an isolated part within a system that provides a specially protected runtime environment. The TEE can be part of the main processor (CPU) or part of the system-on-chip (SoC). Only authorised entities are allowed to introduce or modify applications or code within the TEE. The attestation of the TEE and the application running within the TEE serves to validate the trustworthiness of the processing.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-30.01AC", + "Description": "The cloud service provider documents and implements a technical concept for confidential computing, demonstrating how certain information security risks are mitigated (cf. OIS-07). The concept includes at least the following technical measures and procedures: - Usage of Trusted Execution Environments (TEEs) or secure enclaves to process sensitive data (data in use) in a protected environment;- Documentation of all associated interfaces;- Consideration of available hardware attestations;- Utilisation of encryption techniques to secure data during processing, including secure key management;- Measures to ensure the integrity and authenticity of the data and the executing code within the TEE (remote attestation);- Implementation of monitoring and logging mechanisms to detect and respond to security incidents; and- Conducting regular security reviews and penetration tests (cf. OPS-22) on an event-driven basis, but at least annually, to verify the effectiveness of confidential computing measures.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-30 Security Controls", + "Type": "Additional (Complementing)", + "AboutCriteria": "Confidential Computing within the meaning of this criterion uses hardware-based, attested TEEs to protect the confidentiality and integrity of data during processing ('in use'). A TEE represents an isolated part within a system that provides a specially protected runtime environment. The TEE can be part of the main processor (CPU) or part of the system-on-chip (SoC). Only authorised entities are allowed to introduce or modify applications or code within the TEE. The attestation of the TEE and the application running within the TEE serves to validate the trustworthiness of the processing.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-31.01B", + "Description": "If the cloud service comprises capabilities for Confidential Computing, the cloud service provider offers remote attestation functionalities for data in-use protection.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-31 Confidential Computing - Remote Attestation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-31.02B", + "Description": "Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-31 Security Policies", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "compute_instance_confidential_computing_enabled", + "compute_instance_default_service_account_in_use_with_full_api_access", + "compute_instance_encryption_with_csek_enabled", + "dataproc_encrypted_with_cmks_disabled" + ] + }, + { + "Id": "OPS-31.03B", + "Description": "Remote attestation functionalities comprise an interface that allows the customer to verify the integrity of the remote attestation.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-31 Security Policies", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-31.01AC", + "Description": "The cloud service provider clearly defines, documents and communicates the available attestation levels.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-31 Security Policies", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-31.02AC", + "Description": "The information is part of the guidelines and recommendations for the secure use of the cloud service provided (cf. PSS-01).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-31 Security Policies", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-32.01B", + "Description": "Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle regarding the following aspects: - Image creation, testing, and accreditation;- Image storage and retrieval;- Container deployment and management;- Container operations; and- Decommissioning of images and container.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-32 Guideline for Container Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-32.02B", + "Description": "The guidelines and instructions should describe measures along the life cycle of containers and address at least the following aspects: - Containers are inventoried according to a documented process (cf. AM-02, AM-03, AM-09);- The need for malware protection is assessed and, if necessary, ensured (cf. OPS-05);- Logging and monitoring of events takes place along the container lifecycle and is executed according to a defined logging concept (cf. OPS-10, OPS-12);- Cloud service customer data is separated based on a risk analysis (cf. OPS-29);- Access to the container host should take place in accordance with a roles and rights concept and a policy for managing access and access authorisations (cf. IAM-01, IAM-06);- Data stored on containers and data in transit should be encrypted as far as possible by the provider in accordance with the encryption policy (cf. CRY-01);- Measures to ensure network security are established. This includes, for example, measures to detect network anomalies (cf. COS-01 and COS-03) such as unexpected data flows within the network or unwanted access attempts;- Changes to containers and images follow a regulated process (cf. DEV-03); and- Hardening processes are carried out according to general industry standards to ensure that no unnecessary system services are executed (cf. PSS-11).", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-32 Security Procedures", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudstorage_bucket_lifecycle_management_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled" + ] + }, + { + "Id": "OPS-33.01B", + "Description": "Guidelines and instructions with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure systems and applications in the responsibility of the cloud service provider are patched within a suitable time frame depending on contractual agreements and identified vulnerabilities or exploits. These guidelines and instructions contain specifications regarding the following aspects: - Software is kept up-to-date with the latest security patches;- Patches are scheduled within maintenance windows, where applicable, to minimise service disruption; and- Patches are tested in non-production environments before they are rolled out into the production environment, provided testing was successful. Mechanisms are in place to revert to previous software versions in case of unexpected issues.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-33 Managing Vulnerabilities - Patch Management", + "Type": "Basic", + "AboutCriteria": "Patches are defined as software updates to systems, applications or network components with the goal of increasing security by addressing issues, vulnerabilities or exploits.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-33.02B", + "Description": "Patch management procedures are harmonised with the cloud service provider's overall software change management process.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-33 Security Standards", + "Type": "Basic", + "AboutCriteria": "Patches are defined as software updates to systems, applications or network components with the goal of increasing security by addressing issues, vulnerabilities or exploits.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-33.03B", + "Description": "Patches provided by third parties are identified, tested and deployed.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-33 Security Standards", + "Type": "Basic", + "AboutCriteria": "Patches are defined as software updates to systems, applications or network components with the goal of increasing security by addressing issues, vulnerabilities or exploits.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-33.01AS", + "Description": "Patches provided by third parties are identified, tested and deployed in an automated manner. In case of patches where manual intervention is required, an exception handling process for manual patching is defined.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-33 Security Standards", + "Type": "Additional (Sharpening)", + "AboutCriteria": "Patches are defined as software updates to systems, applications or network components with the goal of increasing security by addressing issues, vulnerabilities or exploits.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "OPS-33.04B", + "Description": "Systems are scanned after application of patches to ensure vulnerabilities and exploits are remediated and no new vulnerabilities or exploits were deployed.", + "Attributes": [ + { + "Section": "Operations (OPS)", + "SubSection": "OPS-33 Security Standards", + "Type": "Basic", + "AboutCriteria": "Patches are defined as software updates to systems, applications or network components with the goal of increasing security by addressing issues, vulnerabilities or exploits.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-01.01B", + "Description": "The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and access rights for internal and external employees of the cloud service provider and system components that have a role in automated authorisation processes of the cloud service provider.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-01 Policy for User Accounts and Access Rights", + "Type": "Basic", + "AboutCriteria": "External employees include freelancers, temporary workers, suppliers and service providers with access to system components.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties", + "iam_sa_no_administrative_privileges", + "bigquery_dataset_public_access" + ] + }, + { + "Id": "IAM-01.02B", + "Description": "These documents address at least the following aspects: - Aspects to be considered for making access control decisions;- Assignment of unique usernames;- Granting and modifying user accounts and access rights based on the 'least-privilege-principle' and the 'need-to-know' principle;- Use of a role-based mechanism for the assignment of access rights;- Definition of the different types of identities and role-based access supported, and assignment of access control parameters and roles to be considered for each type;- Separation of duties between operational and monitoring functions ('Separation of Duties');- Assigning and monitoring privileged access rights;- Separation of duties between managing, approving and assigning user accounts and access rights;- Approval by authorised individual(s) or system(s) for granting or modifying user accounts and access rights before cloud service customer data, cloud service derived data and cloud service provider data can be accessed;- Regular review of assigned user accounts and access rights;- Blocking and removing access accounts in the event of inactivity;- Specific measures for the management of identities used infrequently for emergency recovery and similar scenarios;- Time-based or event-driven removal or adjustment of access rights in the event of changes to job responsibility;- Two-factor or multi-factor authentication for users with privileged access;- Remote access and access across geographic boundaries;- Requirements for the approval and documentation of the management of user accounts and access rights;- Requirement to review access logs at least every month; and- Measures to be taken in the event of potential identity compromise, such as disabling and removing identities.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-01 Identity and Access Management", + "Type": "Basic", + "AboutCriteria": "System components in the sense of the criterion are defined in OPS-26. Automated authorisation processes in the sense of this basic criterion concern procedures for automated software provisioning (continuous delivery) as well as for automated provisioning and deprovisioning of user accounts and access rights based on approved requests. For containers, user accounts and access rights should be managed according to a regulated process, especially for automated authorisation processes in container environments.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-01.03B", + "Description": "The cloud service provider links the policy for user accounts and access rights with the physical access control policy defined in PS-04, to ensure that access to premises and buildings related to the cloud service provided is also controlled.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-01 Identity and Access Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-01.04B", + "Description": "For the given identity under the responsibility of the cloud service provider, the cloud service provider is able to provide the list of the access rights currently granted to that identity.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-01 Identity and Access Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-02.01B", + "Description": "Specified procedures for granting and modifying user accounts and access rights for internal and external employees of the cloud service provider as well as for system components involved in automated authorisation processes of the cloud service provider ensure compliance with the role and rights concept as well as the policy for managing user accounts and access rights.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-02 Granting and Change of User Accounts and Access Rights", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-02.02B", + "Description": "If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-02 Access Control", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.01B", + "Description": "The cloud service provider has a risk-based procedure for managing user accounts in place (cf. IAM-01), taking into account the types of data accessible via the user accounts of internal and external employees.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Risk-Based Procedure for Locking and Withdrawal of User Accounts", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.02B", + "Description": "As part of this procedure, specific parameters for automatically locking and withdrawing access due to inactivity or multiple failed login attempts are defined, with exceptions for identities to be used in emergency recovery and similar scenarios.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities. Locking can result from a longer absence of the employee, for example, due to illness, parental leave, or sabbatical.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.03B", + "Description": "The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service provider's responsibility to which privileged access rights are assigned.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.01AS", + "Description": "The cloud service provider documents and implements a process to monitor stolen and compromised credentials and to disable any identity for which an issue is identified, pending a review by an authorised person. This process is implemented on all identities under the cloud service provider's responsibility.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Additional (Sharpening)", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.04B", + "Description": "Such processes include an exception mechanism for cases where all identities needed to manage the situation are potentially compromised.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.01AC", + "Description": "The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Additional (Complementing)", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "IAM-03.02AC", + "Description": "The cloud service provider validates the effectiveness of its procedures for locking and withdrawal of user accounts.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Additional (Complementing)", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-03.03AC", + "Description": "Any deviations identified during validation are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-03 Authentication", + "Type": "Additional (Complementing)", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-04.01B", + "Description": "Access rights are promptly adjusted or revoked if the job responsibilities of the cloud service provider's internal or external staff or the tasks of system components involved in the cloud service provider's automated authorisation processes change.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities. Changes in the task area of internal and external employees can be triggered by changes in the employment relationship (e.g. termination, transfer) or in contracts and agreements.'", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-04.02B", + "Description": "Privileged access rights are adjusted or revoked within 48 hours after the change taking effect.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-04 Authorization", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities. For privileged access rights the definition in IAM-06 applies.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-04.03B", + "Description": "All other access rights are adjusted or revoked within 14 days.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-04 Authorization", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-04.04B", + "Description": "After revocation, the procedure for granting user accounts and access rights (cf. IAM-02) shall be repeated.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-04 Authorization", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-04.05B", + "Description": "In cases of role changes where temporary access may need to be granted, these access rights are provided in accordance with the procedures for granting access rights outlined in IAM-02.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-04 Authorization", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-04.06B", + "Description": "If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-04 Authorization", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-05.01B", + "Description": "Identities and the associated access rights of internal and external employees of the cloud service provider as well as of system components that play a role in automated authorisation processes of the cloud service provider are reviewed at least once a year to ensure that they still correspond to the actual area of use.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-05 Regular Review of Access Rights", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.As an alternative to the regular reviews of access rights, time-bound access rights that automatically expire may also be issued.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-05.02B", + "Description": "The review is carried out by authorised persons from the cloud service provider's organisational units, who can assess the appropriateness of the assigned access rights based on their knowledge of the task areas of the employees or system components.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-05 Privileged Access Management", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.As an alternative to the regular reviews of access rights, time-bound access rights that automatically expire may also be issued.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-05.03B", + "Description": "Identified deviations are dealt with promptly, but no later than seven days after their detection, by appropriate modification or withdrawal of the access rights.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-05 Privileged Access Management", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.As an alternative to the regular reviews of access rights, time-bound access rights that automatically expire may also be issued.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-05.04B", + "Description": "When revoking identities, the system ensures that all associated IT resources (e.g., virtual machines, storage, access rights) are identified, reassigned, or deleted to prevent the creation of orphaned resources. Clear processes and technical controls are established to identify and handle any orphaned resources that occur despite preventive measures, ensuring their timely reassignment or secure deletion.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-05 Privileged Access Management", + "Type": "Basic", + "AboutCriteria": "This criterion applies to identities that refer to single, multiple or non-human entities.As an alternative to the regular reviews of access rights, time-bound access rights that automatically expire may also be issued.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-05.01AC", + "Description": "Privileged access rights are reviewed at least every six months.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-05 Privileged Access Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-06.01B", + "Description": "Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Privileged Access Rights", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_account_access_approval_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties", + "iam_sa_no_administrative_privileges", + "iam_sa_no_user_managed_keys" + ] + }, + { + "Id": "IAM-06.02B", + "Description": "Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_account_access_approval_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys", + "iam_service_account_unused" + ] + }, + { + "Id": "IAM-06.03B", + "Description": "Non-nominative technical users shall only be accessed through authentication with a personalised user account.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-06.04B", + "Description": "Activities of users with privileged access rights are logged in order to detect any misuse of privileged access in suspicious cases.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "IAM-06.05B", + "Description": "The logged information is automatically monitored for defined events that may indicate misuse.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "IAM-06.06B", + "Description": "When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events). Misused privileged access rights can be treated e.g. as a security incident, cf. SIM-01.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "IAM-06.07B", + "Description": "In the event of proven misuse of privileged access rights, disciplinary measures are taken in accordance with HR-04.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-06.08B", + "Description": "For Docker containers and images, activities of users with privileged access shall be logged according to OPS-10.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-06.09B", + "Description": "The cloud service provider requires two- or more factor authentication for accessing the administration interfaces used by the cloud service provider.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-06.01AC", + "Description": "The cloud service provider maintains an up-to-date inventory of the identities under its responsibility that have privileged access rights.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-06.02AC", + "Description": "The cloud service provider reviews every six months the list of internal and external employees who are responsible for an identity assigned to a non-human entity within its scope of responsibility.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-06 Identity Lifecycle Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "Privileged access rights in the sense of the criterion are those that enable employees of the cloud service provider to perform any of the following activities: - Read or write access to the cloud service customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the cloud service provider; and- Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud service customers (also indirectly, e.g. by deactivating the logging and monitoring of security-relevant events).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.01B", + "Description": "The cloud service provider implements sufficient partitioning measures between the system components for providing the cloud service and system components of its other information systems, and suitable measures for partitioning between the cloud service customers (cf. OPS-28 and OPS-29).", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access to Cloud Service Customer Data", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that their contracts with the cloud service provider include a comprehensive list of all instances where the provider might access customer data in an unencrypted form. Cloud service customers verify that these conditions are thoroughly documented before engaging the services, allowing them to make informed decisions about data security and compliance. Cloud service customers ensure through suitable controls that they provide a response to data access requests by the cloud service provider within a specified timeframe as agreed upon in the contractual agreements." + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.02B", + "Description": "The cloud service provider designs the system so that the technical infrastructure is clearly separated from the management tools and the cloud service customer data it hosts.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.03B", + "Description": "Unless legally forbidden, the cloud service customer is informed by the cloud service provider whenever internal or external employees of the cloud service provider read or write to the cloud service customer data processed, stored or transmitted in the cloud service or have accessed it without the prior consent of the cloud service customer. The information is provided whenever cloud service customer data is/was accessed in unencrypted form or the contractual agreements with customers do not explicitly exclude informing the customer of such access.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Basic", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.01AS", + "Description": "Access to cloud service customer data and cloud service derived data by internal or external employees of the cloud service provider requires the prior consent of an authorised department of the cloud service customer, provided that the cloud service customer's data is accessible in unencrypted form or contractual agreements do not explicitly exclude such consent. Additionally, if encrypted data and its decryption key are stored separately within the same cloud environment, prior consent is required not only for accessing the decryption key but also for accessing the encrypted data itself (potentially together with the key).", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Additional (Sharpening)", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.04B", + "Description": "Unless contractually agreed otherwise, the information contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The information is sufficiently detailed to enable subject matter experts of the cloud service customer to assess the risks of the access.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Basic", + "AboutCriteria": "Subject matter experts in the sense of this basic criterion are personnel from e.g. IT, Compliance or Internal Audit. Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "IAM-07.02AS", + "Description": "For the consent, the cloud service customer's department is provided with meaningful information about the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The information is sufficiently detailed to enable subject matter experts of the cloud service customer to assess the risks of the access. In addition to the provided information, the cloud service provider specifies a timeframe within which the cloud service customer shall respond to the access request.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Additional (Sharpening)", + "AboutCriteria": "Subject matter experts in the sense of this basic criterion are personnel from e.g. IT, Compliance or Internal Audit. Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.05B", + "Description": "The information is provided in accordance with the contractual agreements, but no later than 72 hours from the initiation of the access.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Basic", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.06B", + "Description": "The cloud service provider makes available to the cloud service customer, through contractual agreements, prior to offering its services, all instances where cloud service provider access in a non-encrypted form to the cloud service customer data processed, stored or transmitted in the cloud service may occur.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Basic", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.03AS", + "Description": "The cloud service provider makes available to the cloud service customer, through contractual agreements, prior to offering its services, all instances where cloud service provider access in a non-encrypted form to the cloud service customer data and cloud service derived data processed, stored or transmitted in the cloud service may occur.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Additional (Sharpening)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.07B", + "Description": "If the cloud service provider offers to its cloud service customers interfaces for administrators and for end users, these interfaces are to be separated from one another, ensuring that access paths for customer administrators differ from those for end users.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.01AC", + "Description": "The cloud service provider includes provisions through contractual agreements for cases where the cloud service provider has access in non-encrypted form to the cloud service customer data processed, stored or transmitted in the cloud service, where it is not feasible to seek prior consent. For example, where troubleshooting the service is necessary to ensure that the cloud service customer data remains confidential, available and its integrity preserved.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Additional (Complementing)", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.02AC", + "Description": "Before granting internal or external employees direct or indirect access to cloud service customer data, including in support operations, the cloud service provider verifies that the internal or external employees performing the action have passed an appropriate assessment or are supervised by employees who have passed an appropriate assessment (cf. HR-01).", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Additional (Complementing)", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-07.03AC", + "Description": "In the case of supervised access, the cloud service provider ensures that: - The access is performed using mechanisms that allow the supervising employees to authorise or deny individual actions and ask for explanations in real time;- The access rights are revoked at the end of the operation;- The operations performed are logged as administration actions;- The supervision solution includes the authentication of the supervised employee and the device from which the supervised access is performed;- The supervision solution logs the operations proposed by the supervised employee and the actions of the supervisor, including the operations denied by the supervisor; and- The supervision solution prevents information flows toward the supervised employee's device.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-07 Access Review and Certification", + "Type": "Additional (Complementing)", + "AboutCriteria": "Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-04. These are to be communicated to cloud service customers as far as it is legally not forbidden.The criteron aims at minimizing the cloud service provider capability to access cloud service customer data. Minimisation of the cloud service providers possibility to access cloud service customer data is often a question of the radius of the collusion circle. I.e. if four-eyes principle for access is applied with the access being logged, then three people build the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the taken measures to enlarge the collusion circle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-08.01B", + "Description": "The allocation of authentication information to access system components used to provide the cloud service to internal and external users of the cloud provider and system components that are involved in automated authorisation processes of the cloud provider is done in an orderly manner that ensures the confidentiality of the information.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Confidentiality of Authentication Information", + "Type": "Basic", + "AboutCriteria": "Authentication information as referred to in the basic criterion is cloud service provider data.", + "ComplementaryCriteria": "If cloud service customers operate virtual machines or containers with the cloud service, they ensure through suitable controls that the confidentiality of the information is also ensured for the allocation of authentication information of the virtual machines or containers." + } + ], + "Checks": [] + }, + { + "Id": "IAM-08.02B", + "Description": "Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Basic", + "AboutCriteria": "Authentication information as referred to in the basic criterion is cloud service provider data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_sa_no_user_managed_keys", + "iam_sa_user_managed_key_rotate_90_days" + ] + }, + { + "Id": "IAM-08.03B", + "Description": "If passwords are used as authentication information, their confidentiality is ensured by the following procedures, as far as technically possible: - Users can initially create the password themselves or shall change an initial password when logging on to the system component for the first time. An initial password loses its validity after a maximum of 14 days;- When creating passwords, compliance with the password specifications (cf. IAM-09) is enforced as far as technically possible;- The user is informed about changing or resetting the password; and- The server-side storage takes place using state-of-the-art cryptographic hash functions, except when passwords are stored for subsequent re-use in the plain text form, for example in a password manager. In this case, stored passwords are protected, using a state-of-the-art cryptographic mechanism.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Basic", + "AboutCriteria": "Authentication information as referred to in the basic criterion is cloud service provider data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-08.04B", + "Description": "Deviations are evaluated by means of a risk analysis and mitigating measures derived from this are implemented.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-08.05B", + "Description": "The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;- Recommendations for renewal of passwords;- Rules on storage of passwords;- Confidentially of personal (or shared) authentication and non-sharing of credentials;- Recommendations on password managers; and- Recommendation to specifically address classical attacks, including phishing, social attacks, and whaling.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "apikeys_api_restrictions_configured", + "apikeys_key_rotated_in_90_days", + "compute_instance_block_project_wide_ssh_keys_disabled", + "dns_rsasha1_in_use_to_key_sign_in_dnssec", + "iam_sa_user_managed_key_rotate_90_days", + "iam_sa_user_managed_key_unused" + ] + }, + { + "Id": "IAM-08.06B", + "Description": "If cryptographic mechanisms are used, they follow the policies and procedures from CRY-01.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "bigquery_dataset_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "bigquery_table_cmk_encryption", + "compute_instance_encryption_with_csek_enabled" + ] + }, + { + "Id": "IAM-08.07B", + "Description": "Any password reset procedure is not valid for more than 48 hours and the password is to be changed by the user after the use of the reset procedure.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-08.01AC", + "Description": "The users sign a declaration in which they assure that they treat personal (or shared) authentication information confidentially and keep it exclusively for themselves (within the members of the group).", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-08 Identity Governance", + "Type": "Additional (Complementing)", + "AboutCriteria": "Authentication information as referred to in the basic criterion is cloud service provider data. Insofar as this is legally binding, declarations can be signed using an electronic signature.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.01B", + "Description": "System components in the cloud service provider's area of responsibility that are used to provide the cloud service authenticate users of the cloud service provider's internal and external employees as well as system components that are involved in the cloud service provider's automated authorisation processes.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Authentication Mechanisms", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "If cloud service customers operate virtual machines or containers with the cloud service, they ensure through suitable controls that the authentication mechanisms cover container-specific scenarios, such as multi-factor authentication for container hosts and registry access." + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.02B", + "Description": "Access to the production environment requires two-factor or multi-factor authentication.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.03B", + "Description": "Within the production environment, user authentication takes place through passwords, digitally signed certificates or procedures that achieve at least an equivalent level of security. If digitally signed certificates are used, administration is carried out in accordance with the guideline for key management (cf. CRY-01).", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "IAM-09.04B", + "Description": "The authentication requirements are derived from a risk assessment and documented, communicated and provided in an authentication policy according to SP-01. Compliance with the requirements is enforced by the configuration of the system components, as far as technically possible. The authentication policy describes at least the following aspects: - The selection of mechanisms suitable for every type of identity and each level of risk;- The protection of credentials used by the authentication mechanism;- The generation and distribution of credentials for new identities;- Rules for the renewal of credentials, including periodic renewals, renewals in case of loss or compromise; and- Rules on the required strength of credentials, together with mechanisms to communicate and enforce the rules.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.05B", + "Description": "It is ensured that all system components under the responsibility of the cloud service provider used to provide the cloud service are neither acquired nor employed with an unchangeable authentication method.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.06B", + "Description": "All authentication mechanisms include a mechanism to disable an identity after a predefined number of unsuccessful attempts.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.07B", + "Description": "For access to non-personal identities assigned to multiple persons, the cloud service provider implements measures that require the users to be authenticated with their identity assigned to a single person, before being able to access these identities assigned to multiple persons.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.01AC", + "Description": "Access to the non-production environment requires two-factor or multi-factor authentication.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-09.02AC", + "Description": "Within the non-production environment, users are authenticated using passwords, digitally signed certificates, or procedures that provide at least an equivalent level of security.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-09 Identity Analytics", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "IAM-10.01B", + "Description": "The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-10 Internal Authorisation Mechanisms", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties", + "bigquery_dataset_public_access", + "cloudsql_instance_public_access", + "cloudsql_instance_sqlserver_remote_access_flag", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "kms_key_not_publicly_accessible" + ] + }, + { + "Id": "IAM-10.02B", + "Description": "The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.", + "Attributes": [ + { + "Section": "Identity and Access Management (IAM)", + "SubSection": "IAM-10 Identity Federation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties", + "bigquery_dataset_public_access", + "cloudsql_instance_public_access", + "cloudsql_instance_sqlserver_remote_access_flag", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "kms_key_not_publicly_accessible" + ] + }, + { + "Id": "CRY-01.01B", + "Description": "Policies and instructions with technical and organisational safeguards for cryptographic mechanisms are documented, communicated and provided according to SP-01, in which the following aspects are described: - Usage of encryption procedures and secure network protocols that correspond to the state-of-the-art;- Usage of hash functions and salt values, that both correspond to the state-of-the-art;- Usage of signature schemes that correspond to the state-of-the-art;- Risk-based provisions for the use of encryption and authentication which are aligned with the information classification schemes (cf. AM-09) and consider the communication channel, type, strength and quality of the encryption;- Requirements for the secure generation, storage, archiving, retrieval, distribution, withdrawal, backup, restoration and deletion of the keys;- Requirements for the rotation of cryptographic keys that follow industry best practices and consider the potential risk of information exposure;- Consideration of relevant legal and regulatory obligations and requirements;- Documentation of a change management process for managing cryptographic, encryption, authentication and key management technology changes; and- Consideration of crypto-agility to allow for efficient substitution of implemented cryptographic mechanisms during their intended lifetimes.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-01 Policy for the Use of Cryptographic Mechanisms", + "Type": "Basic", + "AboutCriteria": "The following Technical Guidelines (valid at the given time) provide recommendations and key lengths for state-of-the-art cryptographic mechanisms: - BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths;- BSI TR-02102-2 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Transport Layer Security (TLS);- BSI TR-02102-3 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Internet Protocol Security (IPSec) and Internet Key Exchange (IKEv2) and- BSI TR-02102-4 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Secure Shell (SSH). If cloud service customers operate virtual machines or containers with the cloud service, appropriate encryption should be provided for virtual machines and containers where possible. A change management process in the sense of the basic criterion can either be covered by the standard change management process described in DEV-03 or can be implemented as a separate process. The risk assessment as part of the Post-Quantum-Cryptography strategy should consider: - The threat landscape posed by advancements in quantum computing;- Advancements in cryptographic mechanisms that are deemed secure against attackers in possession of a quantum computer;- Vulnerabilities inherent to the cryptographic mechanism; and- Vulnerabilities resulting from how cryptographic mechanisms are deployed (e.g. keys which are in use for an extended period of time and the data protected by those keys could already be harvested today and decrypted at a later date).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-01.02B", + "Description": "Reviews of policies and instructions regarding cryptographic mechanisms include checks for compliance with the BSI technical guideline for cryptographic mechanisms valid at the given time (BSI TR-02102). Deviations are analysed and documented in a risk assessment. Remediation measures are to be taken based on risk.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-01 Cryptographic Policy", + "Type": "Basic", + "AboutCriteria": "The following Technical Guidelines (valid at the given time) provide recommendations and key lengths for state-of-the-art cryptographic mechanisms: - BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths;- BSI TR-02102-2 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Transport Layer Security (TLS);- BSI TR-02102-3 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Internet Protocol Security (IPSec) and Internet Key Exchange (IKEv2) and- BSI TR-02102-4 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Secure Shell (SSH). If cloud service customers operate virtual machines or containers with the cloud service, appropriate encryption should be provided for virtual machines and containers where possible. A change management process in the sense of the basic criterion can either be covered by the standard change management process described in DEV-03 or can be implemented as a separate process. The risk assessment as part of the Post-Quantum-Cryptography strategy should consider: - The threat landscape posed by advancements in quantum computing;- Advancements in cryptographic mechanisms that are deemed secure against attackers in possession of a quantum computer;- Vulnerabilities inherent to the cryptographic mechanism; and- Vulnerabilities resulting from how cryptographic mechanisms are deployed (e.g. keys which are in use for an extended period of time and the data protected by those keys could already be harvested today and decrypted at a later date).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-01.01AC", + "Description": "The cloud service provider has defined and documented a Post-Quantum-Cryptography (PQC) strategy according to SP-01 to address threats posed by adversaries in possession of a quantum computer.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-01 Cryptographic Policy", + "Type": "Additional (Complementing)", + "AboutCriteria": "The following Technical Guidelines (valid at the given time) provide recommendations and key lengths for state-of-the-art cryptographic mechanisms: - BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths;- BSI TR-02102-2 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Transport Layer Security (TLS);- BSI TR-02102-3 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Internet Protocol Security (IPSec) and Internet Key Exchange (IKEv2) and- BSI TR-02102-4 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Secure Shell (SSH). If cloud service customers operate virtual machines or containers with the cloud service, appropriate encryption should be provided for virtual machines and containers where possible. A change management process in the sense of the basic criterion can either be covered by the standard change management process described in DEV-03 or can be implemented as a separate process. The risk assessment as part of the Post-Quantum-Cryptography strategy should consider: - The threat landscape posed by advancements in quantum computing;- Advancements in cryptographic mechanisms that are deemed secure against attackers in possession of a quantum computer;- Vulnerabilities inherent to the cryptographic mechanism; and- Vulnerabilities resulting from how cryptographic mechanisms are deployed (e.g. keys which are in use for an extended period of time and the data protected by those keys could already be harvested today and decrypted at a later date).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-01.02AC", + "Description": "The cloud provider's PQC strategy is aligned with cryptography policies and procedures and includes the following aspects: - Maintenance of an inventory of cryptographic mechanisms in use, including priority levels to each inventory item based on the impact and probabilities of the risks posed by quantum computing attacks and the effort to remediate such risks;- Staying informed about encryption measures that are deemed state-of-the-art and secure against adversaries who possess a quantum computer;- Usage of hybrid cryptography models to ensure security for both quantum and non-quantum computing based attacks; and- Definition of trigger events, required resources, transition plans and success criteria for implementation of post-quantum cryptographic mechanisms.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-01 Cryptographic Policy", + "Type": "Additional (Complementing)", + "AboutCriteria": "The following Technical Guidelines (valid at the given time) provide recommendations and key lengths for state-of-the-art cryptographic mechanisms: - BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths;- BSI TR-02102-2 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Transport Layer Security (TLS);- BSI TR-02102-3 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Internet Protocol Security (IPSec) and Internet Key Exchange (IKEv2) and- BSI TR-02102-4 Cryptographic Mechanisms: Recommendations and Key Lengths – Use of Secure Shell (SSH). If cloud service customers operate virtual machines or containers with the cloud service, appropriate encryption should be provided for virtual machines and containers where possible. A change management process in the sense of the basic criterion can either be covered by the standard change management process described in DEV-03 or can be implemented as a separate process. The risk assessment as part of the Post-Quantum-Cryptography strategy should consider: - The threat landscape posed by advancements in quantum computing;- Advancements in cryptographic mechanisms that are deemed secure against attackers in possession of a quantum computer;- Vulnerabilities inherent to the cryptographic mechanism; and- Vulnerabilities resulting from how cryptographic mechanisms are deployed (e.g. keys which are in use for an extended period of time and the data protected by those keys could already be harvested today and decrypted at a later date).", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "bigquery_dataset_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "bigquery_table_cmk_encryption", + "compute_instance_encryption_with_csek_enabled" + ] + }, + { + "Id": "CRY-01.03AC", + "Description": "The PQC strategy, including the inventory and risk assessment, is reviewed at least annually or in case of significant changes impacting the PQC strategy.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-01 Cryptographic Policy", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-02.01B", + "Description": "When implementing changes to cryptographic systems, the cloud service provider performs an evaluation of their potential impact. This process includes an analysis of downstream effects, such as residual risk, costs, and benefits that could arise from the planned changes to prevent any unforeseen consequences on the organisation's cryptographic systems.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-02 Cryptographic Change Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that, if notified about any changes to cryptographic systems by the cloud service provider, they engage actively in a thorough evaluation of potential impacts on their usage of the cloud service." + } + ], + "Checks": [] + }, + { + "Id": "CRY-03.01B", + "Description": "The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents involving cryptographic components.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-03 Review of Cryptography Practices", + "Type": "Basic", + "AboutCriteria": "Further criteria for key management are found in criteria CRY-06, CRY-07, CRY-09 - CRY-19", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_not_publicly_accessible", + "bigquery_dataset_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "bigquery_table_cmk_encryption", + "compute_instance_encryption_with_csek_enabled" + ] + }, + { + "Id": "CRY-04.01B", + "Description": "The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud service provider uses state-of-the-art cryptographic mechanisms to protect the communication during remote access to the production environment, including personnel authentication.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-04 Protection of Data for Transmission (Transport Protection)", + "Type": "Basic", + "AboutCriteria": "When transmitting data with normal protection requirements within the cloud service provider's infrastructure, encryption is not mandatory provided that the data is not transmitted via public networks. In this case, the non-public environment of the cloud service provider can generally be deemed trusted. Configuration of the TLS protocol should comply with the recommendations of the (current) version of the BSI Technical Guideline TR-02102-2 'Cryptographic Procedures: Recommendations and key lengths. Part 2 - Use of Transport Layer Security (TLS)'. Cipher Suites should provide Perfect Forward Secrecy. Generally, the use of wildcard certificates is not considered a secure procedure.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls for those parts of the cloud service under their responsibility that their data is transmitted over encrypted connections in accordance with the respective protection requirements." + } + ], + "Checks": [ + "bigquery_dataset_public_access", + "cloudsql_instance_public_access", + "cloudsql_instance_sqlserver_remote_access_flag", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "kms_key_not_publicly_accessible", + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "CRY-04.01AS", + "Description": "The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-04 Cryptographic Key Lifecycle", + "Type": "Additional (Sharpening)", + "AboutCriteria": "When transmitting data with normal protection requirements within the cloud service provider's infrastructure, encryption is not mandatory provided that the data is not transmitted via public networks. In this case, the non-public environment of the cloud service provider can generally be deemed trusted. Configuration of the TLS protocol should comply with the recommendations of the (current) version of the BSI Technical Guideline TR-02102-2 'Cryptographic Procedures: Recommendations and key lengths. Part 2 - Use of Transport Layer Security (TLS)'. Cipher Suites should provide Perfect Forward Secrecy. Generally, the use of wildcard certificates is not considered a secure procedure.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "bigquery_dataset_public_access", + "cloudsql_instance_public_access", + "cloudsql_instance_sqlserver_remote_access_flag", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "kms_key_not_publicly_accessible", + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "CRY-05.01B", + "Description": "The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-05 Encryption of Sensitive Data at Rest", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls for those parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution), that their data is encrypted during storage in accordance with the respective protection requirements." + } + ], + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "cloudsql_instance_automated_backups", + "dataproc_encrypted_with_cmks_disabled" + ] + }, + { + "Id": "CRY-05.02B", + "Description": "The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-05 Data Encryption", + "Type": "Basic", + "AboutCriteria": "An exception to the requirement that keys are known only to the cloud service customers may be the use of a master key by the cloud service provider. If the cloud service provider uses a master key, the cloud service provider regularly tests the suitability of the design and operating effectiveness of the respective controls. The requirement of 'known to the customer exclusively' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext. This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "dns_rsasha1_in_use_to_key_sign_in_dnssec", + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_sa_no_user_managed_keys" + ] + }, + { + "Id": "CRY-05.03B", + "Description": "The procedures for the use of private keys, including any exceptions, are contractually agreed with the cloud service customer.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-05 Data Encryption", + "Type": "Basic", + "AboutCriteria": "An exception to the requirement that keys are known only to the cloud service customers may be the use of a master key by the cloud service provider. If the cloud service provider uses a master key, the cloud service provider regularly tests the suitability of the design and operating effectiveness of the respective controls. The requirement of 'known to the customer exclusively' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext. This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-05.04B", + "Description": "The cloud service provider notifies cloud service customers of security relevant updates of these procedures and technical safeguards and of changes in the storage of cloud service customer data that may affect the confidentiality of the data.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-05 Data Encryption", + "Type": "Basic", + "AboutCriteria": "An exception to the requirement that keys are known only to the cloud service customers may be the use of a master key by the cloud service provider. If the cloud service provider uses a master key, the cloud service provider regularly tests the suitability of the design and operating effectiveness of the respective controls. The requirement of 'known to the customer exclusively' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext. This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-05.01AC", + "Description": "The cloud service provider ensures that secure encryption mechanisms are in place to prevent the recovery of cloud service customer data when resources are reallocated or physical media are recovered.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-05 Data Encryption", + "Type": "Additional (Complementing)", + "AboutCriteria": "An exception to the requirement that keys are known only to the cloud service customers may be the use of a master key by the cloud service provider. If the cloud service provider uses a master key, the cloud service provider regularly tests the suitability of the design and operating effectiveness of the respective controls. The requirement of 'known to the customer exclusively' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext. This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-06.01B", + "Description": "Procedures and technical safeguards for the secure generation of keys for different cryptographic systems and applications are documented and implemented. These safeguards should require the use of secure random bit generators or generation based on keys that were created in this fashion.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-06 Secure Key Generation", + "Type": "Basic", + "AboutCriteria": "For the definition of secure random number generators, cloud service providers should refer to BSI TR-02102-1 (Chapter 8). The cloud service provider protects the keys which are created and inserted into the cloud service by the cloud service customers according to the same criteria as the keys created by the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-07.01B", + "Description": "The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this decision is transparently communicated to the customer.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-07 Rotation of Cryptographic Keys", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "apikeys_key_rotated_in_90_days", + "kms_key_rotation_enabled", + "iam_sa_user_managed_key_rotate_90_days" + ] + }, + { + "Id": "CRY-08.01B", + "Description": "The cloud service provider has documented and implemented procedures to securely issue and obtain public-key certificates, ensuring the integrity and authenticity of cryptographic keys. These procedures include: - Verification of identity before issuing public-key certificates to ensure they are granted to legitimate entities;- Secure methods for issuing certificates to prevent unauthorised access; and- Procedures for obtaining public-key certificates from trusted Certificate Authorities to ensure the authenticity of the certificates used.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-08 Public-Key Certificate Issuance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-09.01B", + "Description": "The cloud service provider has documented and implemented procedures and technical measures to ensure that cryptographic keys are provisioned and activated securely within its area of responsibility. These procedures include the verification of identity and authorisation before provisioning and activating keys to ensure they are granted to legitimate entities.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-09 Secure Key Provisioning", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-09.02B", + "Description": "Provisioned keys include activation and deactivation dates to ensure that their use is time limited.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-09 Cryptographic Testing", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "apikeys_key_rotated_in_90_days", + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_rotation_enabled" + ] + }, + { + "Id": "CRY-10.01B", + "Description": "The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and addressing the geographic residency of keys to comply with legal, regulatory, and security requirements.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-10 Secure Storage of Keys", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_role_kms_enforce_separation_of_duties", + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ] + }, + { + "Id": "CRY-10.01AC", + "Description": "For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-10 Cryptographic Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudstorage_bucket_public_access", + "kms_key_not_publicly_accessible" + ] + }, + { + "Id": "CRY-11.01B", + "Description": "The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to authorised personnel based on the principle of least privilege;- Support of later recovery of information through archived keys;- Retention of archived keys only for as long as needed and secure destruction afterwards; and- Logging of all activities related to the storage and recovery of archived keys.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-11 Cryptographic Key Archival", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "apikeys_key_rotated_in_90_days", + "kms_key_rotation_enabled", + "iam_sa_user_managed_key_rotate_90_days" + ] + }, + { + "Id": "CRY-12.01B", + "Description": "The cloud service provider has documented and implemented procedures to oversee the transition of cryptographic keys, including their movement into and out of suspension. These procedures ensure that all key transitions are thoroughly monitored, reviewed, and approved to maintain security and compliance with applicable laws and regulations.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-12 Cryptographic Key Transition Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-13.01B", + "Description": "The cloud service provider manages the use of compromised cryptographic keys to ensure they are only used in controlled circumstances and solely for decryption or verification (in case of signature keys), while adhering to legal and regulatory requirements.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-13 Handling of Compromised Keys", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-13.02B", + "Description": "The cloud service provider notifies affected customers without undue delay that their keys have been compromised and will no longer be used for encryption.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-13 Cryptographic Monitoring", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-14.01B", + "Description": "The cloud service provider has documented and implemented procedures to deactivate cryptographic keys once they expire. These procedures ensure that: - Expired keys are no longer used for encryption purposes, but may still be used for decryption if necessary;- Expired keys are no longer used for signature creation, but may still be used for signature verification;- Deactivated keys are eventually destroyed when they are no longer required, with relevant metadata retained for auditing; and- All actions related to key deactivation and destruction are recorded in the key management system to maintain a detailed audit log.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-14 Secure Deactivation of Cryptographic Keys", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-15.01B", + "Description": "If pre-shared keys or wildcard certificates are used, the cloud service provider has documented and implemented dedicated procedures and technical measures to ensure their secure use and provisioning.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-15 Requirements for Pre-Shared Keys", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-16.01B", + "Description": "The cloud service provider has assessed the balance between conducting backups of key material stored in a Hardware Security Module (HSM) for key restoration and building redundancy or comparable measures for securing keys to ensure operational continuity. This assessment includes evaluating the risk of key exposure if control over the key material is lost. Decisions regarding whether to use the backups of keys or to establish redundancy are documented, and the chosen measures are reviewed for their effectiveness and compliance with legal and regulatory requirements.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-16 Operational Continuity for Key Management", + "Type": "Basic", + "AboutCriteria": "The cloud service provider should consider the following options for safeguarding key material: - Backup of keys: Encrypted backups of keys are stored securely outside the HSM. The backup process should ensure that the keys are encrypted during storage and transit to prevent unauthorised access. Regular testing of backup and recovery procedures should be carried out to verify the effectiveness and integrity of the backups. Backups outside a HSM should only be considered after dilligent risk analysis. - Redundant HSMs: Implementing multiple HSMs in geographically dispersed locations to create redundancy to ensure that keys remain available and secure even if one HSM fails. The HSMs should be synchronised to ensure consistency of key material across all devices. Regular health checks and failover tests are necessary to ensure that redundancy mechanisms function correctly. The particular manner this redundancy is built may depend on the details of the contractual agreements between provider and customer. E.g. when the customer choose a particular location, zone or region, this choice also applies to the redundancy mentioned in this criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-16.02B", + "Description": "Procedures for the recovery of lost or corrupted keys are in place.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-16 Cryptographic Governance", + "Type": "Basic", + "AboutCriteria": "The cloud service provider should consider the following options for safeguarding key material: - Backup of keys: Encrypted backups of keys are stored securely outside the HSM. The backup process should ensure that the keys are encrypted during storage and transit to prevent unauthorised access. Regular testing of backup and recovery procedures should be carried out to verify the effectiveness and integrity of the backups. Backups outside a HSM should only be considered after dilligent risk analysis. - Redundant HSMs: Implementing multiple HSMs in geographically dispersed locations to create redundancy to ensure that keys remain available and secure even if one HSM fails. The HSMs should be synchronised to ensure consistency of key material across all devices. Regular health checks and failover tests are necessary to ensure that redundancy mechanisms function correctly. The particular manner this redundancy is built may depend on the details of the contractual agreements between provider and customer. E.g. when the customer choose a particular location, zone or region, this choice also applies to the redundancy mentioned in this criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-17.01B", + "Description": "The cloud service provider has documented and implemented procedures and technical measures to monitor and document the lifecycle of cryptographic keys and materials. These measures ensure detailed records of each key from creation to destruction, including any status changes.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-17 Cryptographic Key Lifecycle Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "CRY-18.01B", + "Description": "In the case that external key management systems (KMS) are integrated into the service, the cloud service provider ensures that the procedures and technical measures for the usage of external key management systems (KMS) are established. The following aspects are taken into account: - The external KMS have recognised security certifications that reflect the state of the art to comply with legal, regulatory and contractual requirements;- The integration of the external KMS into the cloud infrastructure is secure to ensure the confidentiality, integrity, and availability of the keys;- Strict access control are implemented to ensure that only authorised users and systems can access the keys (cf. IAM-01);- Procedures for the regular rotation and renewal of keys are defined and implemented to ensure the security of the keys (cf. CRY-07); and- All accesses and operations on the external KMS are logged and monitored to detect and respond to suspicious activities.The cloud service provider ensures that the external KMS is regularly checked for vulnerabilities and updated to meet current threats and technological developments.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-18 Usage of External Key Management Systems", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure that their own key management procedures are compatible with the requirements of the external KMS and that they implement appropriate controls to ensure the security of their keys." + } + ], + "Checks": [] + }, + { + "Id": "CRY-19.01B", + "Description": "The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud environment;- Logging of all activities related to customer-managed keys; and- Definition of access control mechanisms to enable that only authorised users can gain access to customer-managed keys.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-19 Secure Handling of Customer Managed Keys", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that their agreements with the cloud service provider include robust procedures and technical safeguards for the secure handling of customer-managed cryptographic keys. Cloud service customers ensure that these procedures address the secure integration of their keys into the cloud environment, comprehensive logging of all activities related to their keys, and clearly defined access control mechanisms to restrict access solely to authorised users." + } + ], + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_sa_user_managed_key_rotate_90_days" + ] + }, + { + "Id": "CRY-20.01B", + "Description": "The cloud service provider ensures that the procedures and technical measures for cryptography are regularly updated to align with the state of the art. The following aspects are taken into account: - Ensure that all cryptographic guidelines are up to date;- All changes and adjustments to key management procedures are documented and traceable;- A regular review cycle is defined to ensure that the procedures and measures always align with the state of the art; and- Employees responsible for key management are regularly trained and informed about respective changes.", + "Attributes": [ + { + "Section": "Cryptography and Key Management (CRY)", + "SubSection": "CRY-20 Regular Updates of Cryptographic Mechanisms and Procedures", + "Type": "Basic", + "AboutCriteria": "The state-of-the-art of cryptographic mechanisms and secure network protocols is specified in the following BSI Technical Guidelines valid at the given time: - BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths;- BSI TR-02102-2 Cryptographic Mechanisms: Use of Transport Layer Security (TLS);- BSI TR-02102-3 Cryptographic Mechanisms: Use of Internet Protocol Security (IPSec) and Internet Key Exchange (IKEv2); and- BSI TR-02102-4 Cryptographic Mechanisms: Use of Secure Shell (SSH).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-01.01B", + "Description": "Based on the results of a risk analysis carried out according to OIS-07, the cloud service provider has implemented technical safeguards which are suitable to promptly detect and respond to attacks on the network of information systems used for provisioning of the cloud service.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-01 Technical Safeguards", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls for parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution) that they detect and respond to network-based attacks, based on anomalous inbound and outbound traffic patterns (e.g. MAC spoofing and ARP poisoning attacks) and/or Distributed Denial of Service (DDoS), in a timely manner." + } + ], + "Checks": [] + }, + { + "Id": "COS-01.02B", + "Description": "For these technical safeguards, technologies are used that provide protection and prevention at multiple tiers (defence in depth) within the cloud service to mitigate the risk of a vulnerability or bypass technique being able to effectively breach the deployed defensive systems. This includes network-based cyber attacks such as: - Attacks on the basis of irregular incoming or outgoing traffic patterns;- Distributed Denial-of-Service (DDoS) attacks;- Spoofing attacks;- Code injection attacks;- DNS tunneling; and- IoT attacks targeting devices within a network.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-01 Communication Security", + "Type": "Basic", + "AboutCriteria": "Technical safeguards that provide protection and prevention at multiple tiers are e.g. a special separation in Identity and Access Management, separate logging for protective systems and Web Application Firewalls (WAFs) for accessing protective systems. Network-based attacks can be conducted e.g. with MAC spoofing and ARP poisoning attacks. Technical measures to prevent unknown physical or virtual devices from joining a physical or virtual network can be based on e.g. MACSec according to IEEE 802.1X:2010.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-01.03B", + "Description": "Data from corresponding technical safeguards implemented (cloud service provider data) is fed into the organisation's SIEM system (cf. OPS-13), so that (counter-) measures regarding correlating events can be initiated. The safeguards are documented, communicated and provided in accordance with SP-01.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-01 Communication Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-01.01AC", + "Description": "Technical measures ensure that no unknown (physical or virtual) devices join the cloud service provider's (physical or virtual) network.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-01 Communication Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "Technical safeguards that provide protection and prevention at multiple tiers are e.g. a special separation in Identity and Access Management, separate logging for protective systems and Web Application Firewalls (WAFs) for accessing protective systems. Network-based attacks can be conducted e.g. with MAC spoofing and ARP poisoning attacks. Technical measures to prevent unknown physical or virtual devices from joining a physical or virtual network can be based on e.g. MACSec according to IEEE 802.1X:2010.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-02.01B", + "Description": "Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be separated and in which cases cloud service customers are to be logically or physically separated;- Which communication relationships and which network and application protocols are permitted in each case;- How the data traffic for administration and monitoring is separated from each on network level;- Which internal, cross-partition communication is permitted; and- Which cross-network communication is allowed. The cloud service provider establishes and maintains an accurate representation of the technical and logical structure of the cloud service provider's systems based on its network topology documentation (cf. COS-07) and asset inventory (cf. AM-02).", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-02 Security Requirements for Connections in the Cloud Service Provider's Network", + "Type": "Basic", + "AboutCriteria": "Cross-partition communication can be realised for e.g. individual regions or locations via e.g. WAN, LAN, VPN, RAS.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudstorage_bucket_public_access", + "compute_public_address_shodan", + "bigquery_dataset_cmk_encryption", + "compute_network_not_legacy", + "compute_network_dns_logging_enabled", + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "COS-03.01B", + "Description": "The cloud service provider distincts between trusted and untrusted networks. Based on a risk assessment according to OIS-07, these are separated into different security zones for internal and external network areas (and DMZ, if applicable).", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-03 Monitoring of Connections in the Cloud Service Provider's Network", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the virtual networks within the cloud service for which they are responsible are designed, configured and documented in accordance with their network security requirements (e.g. logical segmentation of the cloud service customer's organisational units)." + } + ], + "Checks": [] + }, + { + "Id": "COS-03.02B", + "Description": "Physical and virtualised network environments are designed and configured to restrict and monitor the established connection to trusted or untrusted networks according to the defined security requirements.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-03 Data Transmission Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_sqlserver_user_connections_flag", + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "COS-03.03B", + "Description": "The cloud service provider ensures that the configuration of networks matches the security requirements (cf. COS-02) regardless of the means used to create the configuration. The cloud service provider reviews at least annually the design and implementation of configuration of the connections with regard to the defined security requirements.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-03 Data Transmission Security", + "Type": "Basic", + "AboutCriteria": "The review of the security requirements depends on the measures implemented to design the networks, e.g. monitoring and reviewing firewall rules or log files for abnormalities as well as visual inspections of physical network components for changes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-03.04B", + "Description": "Identified vulnerabilities and deviations are subject to risk assessment in accordance with the risk management procedure (cf. OIS-07) and follow-up measures are defined and tracked (cf. OPS-18).", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-03 Data Transmission Security", + "Type": "Basic", + "AboutCriteria": "The review of the security requirements depends on the measures implemented to design the networks, e.g. monitoring and reviewing firewall rules or log files for abnormalities as well as visual inspections of physical network components for changes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-03.05B", + "Description": "At specified intervals, the business justification for using all services, protocols, and ports is reviewed. The review also includes the justifications for compensatory measures for the use of protocols that are considered insecure.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-03 Data Transmission Security", + "Type": "Basic", + "AboutCriteria": "The review of the security requirements depends on the measures implemented to design the networks, e.g. monitoring and reviewing firewall rules or log files for abnormalities as well as visual inspections of physical network components for changes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-04.01B", + "Description": "Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-04 Cross-Network Access", + "Type": "Basic", + "AboutCriteria": "Cross-network access is access from one network to another network via a defined network perimeter.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that access is controlled according to their protection needs by security gateways on the perimeters of the virtual networks within the cloud service for which they are responsible." + } + ], + "Checks": [ + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_network_not_legacy", + "compute_network_dns_logging_enabled" + ] + }, + { + "Id": "COS-04.01AS", + "Description": "Each network perimeter is controlled by redundant and highly available security gateways.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-04 Communication Monitoring", + "Type": "Additional (Sharpening)", + "AboutCriteria": "Cross-network access is access from one network to another network via a defined network perimeter.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-05.01B", + "Description": "There are separate networks for the administrative management of the infrastructure and for the operation of management consoles. These networks are logically or physically separated from the cloud service customer's network and protected from unauthorised access by multi-factor authentication (cf. IAM-09).", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-05 Networks for Administration", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-05.02B", + "Description": "Networks used by the cloud service provider to migrate or create virtual machines are also physically or logically separated from other networks.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-05 Communication Encryption", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-05.01AC", + "Description": "When the administration networks are not physically separated from other networks, the administration flows are protected using a state-of-the-art encrypted communication.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-05 Communication Encryption", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-06.01B", + "Description": "Cloud service customer data traffic in jointly used network environments is separated on network level according to a documented concept to ensure the confidentiality and integrity of the data transmitted.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-06 Separation of Data Traffic in Jointly Used Network Environments", + "Type": "Basic", + "AboutCriteria": "If the cloud service provider does not use shared network environments for cloud service customers and instead uses a physical separation, the basic criterion is not applicable. If the suitability and effectiveness of the logical segmentation cannot be assessed with sufficient certainty (e.g. due to a complex implementation), evidence can also be provided based on audit results of expert third parties (e.g. security audits to validate the concept). The separation of stored and processed data is subject of the criterion OPS-24. After successful authentication via an insecure communication channel (HTTP), a secure communication channel (HTTPS) is to be used. With IaaS/PaaS, secure separation is ensured by physically separated networks or strong encryption of the networks. For the definition of state-of-the-art encryption, the BSI Technical Guideline TR-02102 must be considered (cf. CRY-01).", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls for those parts of the cloud service under their responsibility that virtual networks are designed, configured and documented in accordance with their network security requirements (e.g. logical segmentation of organisational units)." + } + ], + "Checks": [] + }, + { + "Id": "COS-06.01AC", + "Description": "In the case of IaaS/PaaS, the secure separation is ensured by physically separated networks or by means of state-of-the-art encrypted VLANs or other network encapsulating techniques.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-06 Communication Authentication", + "Type": "Additional (Complementing)", + "AboutCriteria": "If the cloud service provider does not use shared network environments for cloud service customers and instead uses a physical separation, the basic criterion is not applicable. If the suitability and effectiveness of the logical segmentation cannot be assessed with sufficient certainty (e.g. due to a complex implementation), evidence can also be provided based on audit results of expert third parties (e.g. security audits to validate the concept). The separation of stored and processed data is subject of the criterion OPS-24. After successful authentication via an insecure communication channel (HTTP), a secure communication channel (HTTPS) is to be used. With IaaS/PaaS, secure separation is ensured by physically separated networks or strong encryption of the networks. For the definition of state-of-the-art encryption, the BSI Technical Guideline TR-02102 must be considered (cf. CRY-01).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-07.01B", + "Description": "The documentation of the logical structure of the network used to provide or operate the cloud service is traceable and up-to-date, in order to avoid administrative errors during live operation and to ensure timely recovery in the event of malfunctions in accordance with contractual obligations. The documentation shows how the subnets are allocated, how the network is zoned and segmented, how it connects with third party and public networks and how the data flows between different subnets and system components within the network.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-07 Documentation of the Network Topology", + "Type": "Basic", + "AboutCriteria": "Zoning is a segmentation of the subnets with a firewall implemented at the network perimeters.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-07.02B", + "Description": "The partions, regions, zones or location in which the cloud service customer data is stored are indicated.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-07 Communication Integrity", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-07.03B", + "Description": "In liaison with the inventory of assets (cf. AM-02), the documentation includes the equipment that provides security functions and the servers that host the data or provide sensitive functions.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-07 Communication Integrity", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-07.04B", + "Description": "The cloud service provider performs a full review of the network topology documentation at least once a year.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-07 Communication Integrity", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COS-08.01B", + "Description": "Policies and instructions with technical and organisational safeguards in order to protect the transmission of cloud service customer data, cloud service derived data, cloud service provider data and account data against unauthorised interception, manipulation, copying, modification, redirection, destruction or malware intrusion are documented, communicated and provided according to SP-01. The policies and instructions establish a reference to the Asset Classification and Labelling (cf. AM-09) and cryptography (cf. CRY-01).", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-08 Policies for Data Transmission", + "Type": "Basic", + "AboutCriteria": "A safeguard against unauthorised interception, manipulation, copying, modification, redirection or destruction of data during transmission is e.g. the use of transport encryption according to CRY-04.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the transmitted data transmitted to the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with their protection needs." + } + ], + "Checks": [] + }, + { + "Id": "COS-08.02B", + "Description": "Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.", + "Attributes": [ + { + "Section": "Communication Security (COS)", + "SubSection": "COS-08 Communication Availability", + "Type": "Basic", + "AboutCriteria": "A safeguard against unauthorised interception, manipulation, copying, modification, redirection or destruction of data during transmission is e.g. the use of transport encryption according to CRY-04.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_ssl_connections" + ] + }, + { + "Id": "PI-01.01B", + "Description": "The cloud service provider establishes and maintains policies and procedures to document how the cloud service can be accessed by other cloud services or IT systems of cloud service customers through documented inbound and outbound interfaces. These policies and procedures specifically address: - The use of standardised communication protocols for interactions between different application interfaces to ensure the confidentiality and integrity of the transmitted information according to its protection requirements, and the adequate authentication of the user;- The use of encryption according to CRY-02 in case of communication over untrusted networks;- The use of standardised data formats and common data processing standards to facilitate information processing interoperability; and- The implementation of mechanisms to validate data integrity and establish backup and recovery processes to ensure data security and reliability during exchange, usage and transfer.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-01 Documentation and Safety of Input and Output Interfaces", + "Type": "Basic", + "AboutCriteria": "In this context, an interface is a system access point or library function with a well-defined syntax. It comprises documented methods that allow cloud service customers to securely access and interact with the cloud service, enabling the exchange of data. While these interfaces provide the means for communication with the cloud service, they do not imply that cloud service customers can directly connect their custom systems as if they are natively integrated. Instead, cloud service customers can configure their systems by using methods, such as API calls, and adhering to the specified protocols and data formats provided by the cloud service provider. To ensure seamless and secure communication between interfaces, the cloud service provider uses industry-standard API protocols and implements state-of-the-art transport layer security. The cloud service provider supports cross-platform information processing by employing containerisation technologies and cloud-neutral development frameworks. Infrastructre as Code practices are adopted to standardise infrastructre provisioning. Common data usage policies are defined and enforced to ensure consistent and secure access, utilisation and sharing of data. Upon contract termination, the cloud service provider assists customers in exporting and transferring their data, e.g. by providing technical documentation and data export tools.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the interfaces provided (and their security) are adequate for its protection requirements by means of appropriate checks before the start of use of the cloud service and each time the interfaces are changed." + } + ], + "Checks": [] + }, + { + "Id": "PI-01.02B", + "Description": "The policies and procedures contain clear documentation on the interfaces to provide subject matter experts with detailed guidance to facilitate effective usage for their intended purpose. This documentation is tailored to meet the needs of cloud service customers' subject matter experts and is kept up to date to reflect the current version of the cloud service intended for productive use.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-01 Portability", + "Type": "Basic", + "AboutCriteria": "In this context, an interface is a system access point or library function with a well-defined syntax. It comprises documented methods that allow cloud service customers to securely access and interact with the cloud service, enabling the exchange of data. While these interfaces provide the means for communication with the cloud service, they do not imply that cloud service customers can directly connect their custom systems as if they are natively integrated. Instead, cloud service customers can configure their systems by using methods, such as API calls, and adhering to the specified protocols and data formats provided by the cloud service provider. To ensure seamless and secure communication between interfaces, the cloud service provider uses industry-standard API protocols and implements state-of-the-art transport layer security. The cloud service provider supports cross-platform information processing by employing containerisation technologies and cloud-neutral development frameworks. Infrastructre as Code practices are adopted to standardise infrastructre provisioning. Common data usage policies are defined and enforced to ensure consistent and secure access, utilisation and sharing of data. Upon contract termination, the cloud service provider assists customers in exporting and transferring their data, e.g. by providing technical documentation and data export tools.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PI-01.01AC", + "Description": "The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-01 Portability", + "Type": "Additional (Complementing)", + "AboutCriteria": "In this context, an interface is a system access point or library function with a well-defined syntax. It comprises documented methods that allow cloud service customers to securely access and interact with the cloud service, enabling the exchange of data. While these interfaces provide the means for communication with the cloud service, they do not imply that cloud service customers can directly connect their custom systems as if they are natively integrated. Instead, cloud service customers can configure their systems by using methods, such as API calls, and adhering to the specified protocols and data formats provided by the cloud service provider. To ensure seamless and secure communication between interfaces, the cloud service provider uses industry-standard API protocols and implements state-of-the-art transport layer security. The cloud service provider supports cross-platform information processing by employing containerisation technologies and cloud-neutral development frameworks. Infrastructre as Code practices are adopted to standardise infrastructre provisioning. Common data usage policies are defined and enforced to ensure consistent and secure access, utilisation and sharing of data. Upon contract termination, the cloud service provider assists customers in exporting and transferring their data, e.g. by providing technical documentation and data export tools.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed" + ] + }, + { + "Id": "PI-01.02AC", + "Description": "The cloud service provides cloud service customers with interfaces for custom identity providers to manage cloud user access information and authentication. These interfaces are accompanied by a standardised protocol to facilitate communication between the cloud service and the external identity provider.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-01 Portability", + "Type": "Additional (Complementing)", + "AboutCriteria": "In this context, an interface is a system access point or library function with a well-defined syntax. It comprises documented methods that allow cloud service customers to securely access and interact with the cloud service, enabling the exchange of data. While these interfaces provide the means for communication with the cloud service, they do not imply that cloud service customers can directly connect their custom systems as if they are natively integrated. Instead, cloud service customers can configure their systems by using methods, such as API calls, and adhering to the specified protocols and data formats provided by the cloud service provider. To ensure seamless and secure communication between interfaces, the cloud service provider uses industry-standard API protocols and implements state-of-the-art transport layer security. The cloud service provider supports cross-platform information processing by employing containerisation technologies and cloud-neutral development frameworks. Infrastructre as Code practices are adopted to standardise infrastructre provisioning. Common data usage policies are defined and enforced to ensure consistent and secure access, utilisation and sharing of data. Upon contract termination, the cloud service provider assists customers in exporting and transferring their data, e.g. by providing technical documentation and data export tools.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PI-01.03AC", + "Description": "The interfaces are clearly documented to enable subject matter experts of the cloud user to integrate their identity provider with the cloud service.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-01 Portability", + "Type": "Additional (Complementing)", + "AboutCriteria": "In this context, an interface is a system access point or library function with a well-defined syntax. It comprises documented methods that allow cloud service customers to securely access and interact with the cloud service, enabling the exchange of data. While these interfaces provide the means for communication with the cloud service, they do not imply that cloud service customers can directly connect their custom systems as if they are natively integrated. Instead, cloud service customers can configure their systems by using methods, such as API calls, and adhering to the specified protocols and data formats provided by the cloud service provider. To ensure seamless and secure communication between interfaces, the cloud service provider uses industry-standard API protocols and implements state-of-the-art transport layer security. The cloud service provider supports cross-platform information processing by employing containerisation technologies and cloud-neutral development frameworks. Infrastructre as Code practices are adopted to standardise infrastructre provisioning. Common data usage policies are defined and enforced to ensure consistent and secure access, utilisation and sharing of data. Upon contract termination, the cloud service provider assists customers in exporting and transferring their data, e.g. by providing technical documentation and data export tools.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PI-02.01B", + "Description": "In contractual agreements, the following aspects are defined for provisioning of data, insofar as these are applicable to the cloud service: - Type, scope and format of the cloud service customer data the cloud service provider provides to the cloud service customer;- Delivery methods of the data to the cloud service customer;- Conditions and timeframes for cloud service customer data provisioning throughout the duration of the contractual relationship;- Right of termination of the contract and definition of the timeframe, within which the cloud service provider makes the cloud service customer data available to the cloud service customer after termination of the contract;- Definition of the point in time as of which the cloud service provider makes the cloud service customer data inaccessible to the cloud service customer and deletes these after termination of the contract;- The cloud service customers' responsibilities and obligations to cooperate for the provision of the cloud service customer data; and- Cloud service customer data remains the property of the cloud service customer throughout the entire contractual relationship. After its termination, the data is once again the sole property and possession of the cloud service customer. The definitions are based on the needs of subject matter experts of potential customers who assess the suitability of the cloud service with regard to a dependency on the cloud service provider as well as legal and regulatory requirements.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-02 Contractual Agreements for the Provision of Data", + "Type": "Basic", + "AboutCriteria": "The type and scope of the data and the responsibilities for its provision depend on the service model of the cloud service or the services and functions provided: In the case of IaaS- and PaaS-like services, the cloud service customer is generally responsible for extracting and backing up the data which is stored in the cloud service before termination of the contractual relationship (cf. complementary requirement). The cloud service provider's responsibility is typically limited to the provision of data for the configuration of the infrastructure or platform that the cloud service customer has set up within its environment (e.g. configuration of networks, images of virtual machines and containers). With SaaS, the cloud service customer typically relies on export functions provided by the cloud service provider. Data created by the cloud service customer should be available in the same format as stored in the cloud service. Other data, including relevant log files and metadata, should be available in an applicable standard format, such as CSV, JSON or XML. In Germany, legal requirements for retention can be found, for example, in the German Tax Code (§147 AO) and the German Commercial Code (§257 HGB). These provide for a retention obligation of six or ten years. If contractual agreements do not include the aspects listed in the basic criterion, although these aspects are applicable to the cloud service due to its service model, the criterion is not met and a deviation is to be noted by the auditor.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the data to which they are contractually entitled is requested from the cloud service provider at the end of the contract or accessed via defined interfaces (the type and scope of the data correspond to the contractual agreements that were concluded prior to the use of the cloud service) and that it is stored in accordance with the legal requirements applicable to this data." + } + ], + "Checks": [] + }, + { + "Id": "PI-02.01AC", + "Description": "The design of the aspects is based on legal and regulatory requirements in the environment of the cloud service provider. The cloud service provider identifies the requirements regularly, at least once a year, and checks these for actuality and adjusts the contractual agreements accordingly.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-02 Interoperability", + "Type": "Additional (Complementing)", + "AboutCriteria": "The type and scope of the data and the responsibilities for its provision depend on the service model of the cloud service or the services and functions provided: In the case of IaaS- and PaaS-like services, the cloud service customer is generally responsible for extracting and backing up the data which is stored in the cloud service before termination of the contractual relationship (cf. complementary requirement). The cloud service provider's responsibility is typically limited to the provision of data for the configuration of the infrastructure or platform that the cloud service customer has set up within its environment (e.g. configuration of networks, images of virtual machines and containers). With SaaS, the cloud service customer typically relies on export functions provided by the cloud service provider. Data created by the cloud service customer should be available in the same format as stored in the cloud service. Other data, including relevant log files and metadata, should be available in an applicable standard format, such as CSV, JSON or XML. In Germany, legal requirements for retention can be found, for example, in the German Tax Code (§147 AO) and the German Commercial Code (§257 HGB). These provide for a retention obligation of six or ten years. If contractual agreements do not include the aspects listed in the basic criterion, although these aspects are applicable to the cloud service due to its service model, the criterion is not met and a deviation is to be noted by the auditor.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PI-02.02AC", + "Description": "The cloud service provider also provides cloud service derived data to the cloud service customer upon termination of the contractual relationship. The provision of this data is also defined in the contractual agreements and includes the aspects specified in the basic criterion.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-02 Interoperability", + "Type": "Additional (Complementing)", + "AboutCriteria": "The type and scope of the data and the responsibilities for its provision depend on the service model of the cloud service or the services and functions provided: In the case of IaaS- and PaaS-like services, the cloud service customer is generally responsible for extracting and backing up the data which is stored in the cloud service before termination of the contractual relationship (cf. complementary requirement). The cloud service provider's responsibility is typically limited to the provision of data for the configuration of the infrastructure or platform that the cloud service customer has set up within its environment (e.g. configuration of networks, images of virtual machines and containers). With SaaS, the cloud service customer typically relies on export functions provided by the cloud service provider. Data created by the cloud service customer should be available in the same format as stored in the cloud service. Other data, including relevant log files and metadata, should be available in an applicable standard format, such as CSV, JSON or XML. In Germany, legal requirements for retention can be found, for example, in the German Tax Code (§147 AO) and the German Commercial Code (§257 HGB). These provide for a retention obligation of six or ten years. If contractual agreements do not include the aspects listed in the basic criterion, although these aspects are applicable to the cloud service due to its service model, the criterion is not met and a deviation is to be noted by the auditor.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PI-03.01B", + "Description": "The cloud service provider's procedures for deleting cloud service customer data, cloud service derived data and Account data upon termination of the contractual relationship ensure compliance with the contractual agreements (cf. PI-02), except as required by a valid court order or as needed to fulfil known future financial and legal obligations.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-03 Secure Deletion of Data", + "Type": "Basic", + "AboutCriteria": "Suitable methods for data deletion are e.g. multiple overwriting or deletion of the encryption key.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the legal and regulatory framework (e.g. legal requirements for storage and deletion) is identified and that the deletion of their data is initiated accordingly." + } + ], + "Checks": [] + }, + { + "Id": "PI-03.02B", + "Description": "The deletion procedures prevent recovery by state-of-the-art forensic means.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-03 Data Portability", + "Type": "Basic", + "AboutCriteria": "Suitable methods for data deletion are e.g. multiple overwriting or deletion of the encryption key.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudstorage_bucket_soft_delete_enabled" + ] + }, + { + "Id": "PI-03.03B", + "Description": "The cloud service provider documents the deletion of the cloud service customer data, cloud service derived data and Account data in a manner that enables the cloud service customer to obtain proof of the deletion of its data.", + "Attributes": [ + { + "Section": "Portability and Interoperability (PI)", + "SubSection": "PI-03 Data Portability", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-01.01B", + "Description": "Policies and instructions with technical and organisational measures for the secure development of system components of the cloud service are documented, communicated and provided in accordance with SP-01. The policies and instructions contain guidelines for the entire life cycle of the cloud service and are based on recognised standards and methods with regard to the following aspects: - Security and quality in software development (requirements, design, implementation, testing and verification) including the existence of a security by design principle, enforcing the consideration of information security requirements in the software development phase;- Security and quality in software deployment (including continuous delivery);- Security and quality in operation (reaction to identified faults and vulnerabilities); and- Secure coding standards and practices (reducing the introduction of vulnerabilities in code).", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-01 Policies for the Development/Procurement of System Components", + "Type": "Basic", + "AboutCriteria": "The software provision can be carried out e.g. with Continuous Delivery methods. Accepted standards and methods for secure development are, for example: - ISO/IEC 27034; and- OWASP Secure Software Development Lifecycle (S-SDLC).Minimisation of customer data access during operation can be supported by following robust security models, such as Zero Trust, during cloud architecture development. Furthermore, aspects such as limiting data interfaces, API calls and access as well as ensuring end-to-end-encryption from transit to storage are relevant considerations. For quality assurance in software development, the following can be considered to be relevant processes: - Planning and definition of quality objectives: Definition of quality requirements based on customer needs and objectives, taking into account the requirements of the cloud system to be developed.- Design phase: Carrying out design reviews and inspections of the cloud service to ensure that the design meets the quality requirements.- Development phase: Use of code reviews and pair programming to ensure code quality. Use of static analysis tools to check the code for potential errors and violations of coding standards.- Testing phase: Execution (automated where possible) of various types of tests (e.g. unit tests, integration tests, system tests, acceptance tests) to ensure the functionality and quality of the software.- Integration and continuous integration (CI): Integration of the various software components and continuous checking of the integrations through automated builds and tests. Use of CI/CD pipelines to ensure that the code is regularly integrated and tested.- Release and deployment: Preparation and implementation of the software release in accordance with defined quality standards.- Maintenance and continuous improvement: Monitoring the software in operation to ensure that it continues to meet the quality requirements. This includes post release activities such as bug fixing and performance optimisation processes. Additionally, post-mortem analyses should be performed to learn from incidents and optimise processes for future releases. An accepted standard and a method for quality in development processes is, for example, Google Site Reliability Engineering (SRE). The scope of the DEV criteria and the requirements within includes not only the development of software applications but also platforms, virtual infrastructure, and other system components.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-01.02B", + "Description": "Guidelines for the secure development of the cloud service define principles to ensure the system architecture and software operated by the cloud service provider within the production environment are designed in such a way that access to cloud service customer data by the cloud service provider is minimised wherever possible.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-01 Development Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-01.03B", + "Description": "The policies and instructions for the secure development of system components of the cloud service include measures for the enforcement of specified standards and guidelines, including any applicable automated tools.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-01 Development Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-01.01AC", + "Description": "In procurement, products are preferred which have been certified according to the 'Common Criteria for Information Technology Security Evaluation' (short: Common Criteria - CC) Evaluation Assurance Level EAL 4. If non-certified products are to be procured for available certified products, a risk assessment is carried out in accordance with OIS-07.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-01 Development Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "The software provision can be carried out e.g. with Continuous Delivery methods. Accepted standards and methods for secure development are, for example: - ISO/IEC 27034; and- OWASP Secure Software Development Lifecycle (S-SDLC).Minimisation of customer data access during operation can be supported by following robust security models, such as Zero Trust, during cloud architecture development. Furthermore, aspects such as limiting data interfaces, API calls and access as well as ensuring end-to-end-encryption from transit to storage are relevant considerations. For quality assurance in software development, the following can be considered to be relevant processes: - Planning and definition of quality objectives: Definition of quality requirements based on customer needs and objectives, taking into account the requirements of the cloud system to be developed.- Design phase: Carrying out design reviews and inspections of the cloud service to ensure that the design meets the quality requirements.- Development phase: Use of code reviews and pair programming to ensure code quality. Use of static analysis tools to check the code for potential errors and violations of coding standards.- Testing phase: Execution (automated where possible) of various types of tests (e.g. unit tests, integration tests, system tests, acceptance tests) to ensure the functionality and quality of the software.- Integration and continuous integration (CI): Integration of the various software components and continuous checking of the integrations through automated builds and tests. Use of CI/CD pipelines to ensure that the code is regularly integrated and tested.- Release and deployment: Preparation and implementation of the software release in accordance with defined quality standards.- Maintenance and continuous improvement: Monitoring the software in operation to ensure that it continues to meet the quality requirements. This includes post release activities such as bug fixing and performance optimisation processes. Additionally, post-mortem analyses should be performed to learn from incidents and optimise processes for future releases. An accepted standard and a method for quality in development processes is, for example, Google Site Reliability Engineering (SRE). The scope of the DEV criteria and the requirements within includes not only the development of software applications but also platforms, virtual infrastructure, and other system components.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-02.01B", + "Description": "In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development (requirements, design, implementation, tests and verifications) in accordance with recognised standards and methods, ensuring a security level equivalent to that of the cloud service provider's internal development;- Acceptance testing of the quality of the services provided in accordance with the agreed functional and non-functional requirements; and- Providing evidence that sufficient verifications have been carried out to rule out the existence of known vulnerabilities. Before subcontracting the development of the cloud service or components thereof, the cloud service provider conducts a risk assessment according to SSO-02 that considers at least the following aspects: - Management of source code by the subcontractor;- Availability of source code to the cloud service provider and where applicable, to evaluators;- Human resource procedures implemented by the subcontractor;- Required access to the cloud service provider's development, test and preproduction environments; and- Security procedures related to the management of the subcontractor's service organisations.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-02 Outsourcing of the Development", + "Type": "Basic", + "AboutCriteria": "Outsourced development in the sense of the basic criterion refers to the development of system components used specifically for the cloud service, by a contractor of the cloud service provider. The development takes place according to the processes of the contractor. The purchase of software available on the market as well as the integration of external employees into the processes of the cloud service provider do not constitute outsourcing in the sense of this basic criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-02.01AC", + "Description": "The cloud service provider documents and implements a procedure that makes it possible to supervise and control the outsourced development activity, in order to ensure that the outsourced development activity is compliant with the secure development policy of the cloud service provider and makes it possible to achieve a level of security of the external development that matches that of internal development.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-02 Secure Development", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-02.02AC", + "Description": "Personnel of the cloud service provider run the tests that are relevant for the deployment decision when a change includes the result of outsourced development.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-02 Secure Development", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-03.01B", + "Description": "Policies and instructions with technical and organisational safeguards for change management of system components of the cloud service are documented, communicated and provided according to SP-01 with regard to the following aspects: - Criteria for risk assessment, categorisation and prioritisation of changes and related requirements for the type and scope of testing to be performed, and necessary approvals for the development/implementation of the change and releases for deployment in the production environment by authorised personnel or system components;- Requirements for the performance and documentation of tests;- Requirements for separation of duties during development, testing and release of changes;- Requirements for the proper information of cloud service customers about the type and scope of the change as well as the resulting obligations to cooperate in accordance with the contractual agreements;- Requirements for the documentation of changes in system, operational and user documentation;- Requirements for the implementation and documentation of emergency changes that shall, to the extent possible in the emergency, comply with the same level of security as normal changes;- Requirements for the handling of a change's unexpected effects, including corrective actions; and- Requirements for the development of security features that implement technical mechanisms and safeguards, with increased testing requirements.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-03 Policies for Changes to System Components", + "Type": "Basic", + "AboutCriteria": "Changes in the sense of the basic criterion are those that can lead to changes in the configuration, functionality or security of system components of the cloud service in the production environment. This includes changes to the infrastructure as well as to the source code. If individual changes are combined in a new release, update, patch or comparable software object for the purpose of software provisioning, this software object is deemed to be a change within the meaning of the basic criterion, but not the individual changes contained therein. Changes to the existing network configuration also fall under this criterion and should also undergo a specified procedure, as they are necessary for effective separation of cloud service customers. Changes to the container environments, including the management of container images and versions, should also go through a regulated process. Personnel and system components receive authorisation to approve changes in accordance with the requirements for access and access authorisations (cf. IAM-01) via a specified procedure (cf. IAM-02). Relevant information includes descriptions of e.g. new functions. The cloud service customer's obligations to cooperate can define that, e.g. the cloud service customer has to carry out certain tests. A centralised change management process is not mandatory. The cloud service provider has the flexibility to adopt change management practices that best fit its operational needs, including agile methods, as long as they adhere to the technical and organisational safeguards.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-04.01B", + "Description": "The cloud service provider provides a training programme for regular, target group-oriented security training and awareness for internal and external employees on standards and methods for: - Secure software development and provision as well as on how to use the tools used for this purpose; and- Risks linked to malicious code and best practices to reduce the impact of an infection.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-04 Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-04.02B", + "Description": "The programme is regularly reviewed and updated with regard to the applicable policies and instructions, the assigned roles and responsibilities and the tools used.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-04 Security Requirements", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-05.01B", + "Description": "Design documentation for security features shall be based on a security analysis of the adequacy and planned effectiveness of the features. This documentation shall include a specification of expected inputs, outputs and possible errors.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-05 Design Documentation for Security Features", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-06.01B", + "Description": "In accordance with the applicable policies (cf. DEV-03), changes are subjected to a risk assessment regarding the likelihood of adversely effects on system components concerned and dependencies with other changes, and are categorised and prioritised accordingly.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-06 Risk Assessment, Categorisation and Prioritisation of Changes", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-06.02B", + "Description": "If the risk associated to a planned change is high, then appropriate mitigation measures are taken before deploying the change in the cloud service's production environment.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-06 Security Design", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-06.01AC", + "Description": "In accordance with the contractual agreements, meaningful information about the occasion, time, duration, type and scope of the change is submitted to authorised bodies of the cloud service customer so that they can carry out their own risk assessment before the change is made available in the production environment. Regardless of the contractual agreements, this is done for changes that have the highest risk category based on their risk assessment.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-06 Security Design", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-07.01B", + "Description": "Changes to the cloud service are subject to appropriate testing according to documented test procedures during software development and deployment.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-07 Testing Changes", + "Type": "Basic", + "AboutCriteria": "Tests should be used that contribute to the quality assurance of the software development as well as to the security of the cloud service. The errors and vulnerabilities identified in tests can be assessed, for example, according to the Common Vulnerability Scoring System (CVSS).", + "ComplementaryCriteria": "Where changes are to be tested by the cloud service customers in accordance with the contractual agreements prior to deployment in the production environment, the cloud service customers ensure through suitable controls that the tests are performed appropriately to identify errors. In particular, this includes timely execution of the tests by qualified personnel in accordance with the conditions specified by the cloud service provider." + } + ], + "Checks": [] + }, + { + "Id": "DEV-07.02B", + "Description": "The type and scope of the tests correspond to the risk assessment. The tests are carried out by appropriately qualified personnel of the cloud service provider or by automated test procedures that comply with the state-of-the-art. Cloud service customers are involved into the tests in accordance with the contractual requirements.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-07 Security Implementation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-07.03B", + "Description": "Before using cloud service customer data for tests, the cloud service provider first obtains approval from that cloud service customer and anonymises the cloud service customer data. The cloud service provider ensures the confidentiality of the data during the whole process.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-07 Security Implementation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-07.04B", + "Description": "The tests of the security features provide full coverage of the specification, including all specified error conditions. The documentation of these tests includes at least a description of the test, the initial conditions, the expected outcome and instructions for running the test.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-07 Security Implementation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-07.05B", + "Description": "The severity of the errors and vulnerabilities identified in the tests, which are relevant for the deployment decision, is determined according to defined criteria and actions for timely remediation or mitigation are initiated.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-07 Security Implementation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-07.01AC", + "Description": "Pre-launch penetration tests are carried out during the test phase of the cloud service in accordance with the penetration test concept (cf. OPS-22 additional criterion). The severity of identified vulnerabilities is assessed according to defined criteria and actions for timely remediation or mitigation are initiated.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-07 Security Implementation", + "Type": "Additional (Complementing)", + "AboutCriteria": "Tests should be used that contribute to the quality assurance of the software development as well as to the security of the cloud service. The errors and vulnerabilities identified in tests can be assessed, for example, according to the Common Vulnerability Scoring System (CVSS).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-08.01B", + "Description": "System components for version control and software deployment that are used to manage changes to system components of the cloud service in the production environment are subject to a role and rights concept according to IAM-01 and authorisation mechanisms.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-08 Logging of Changes", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-08.02B", + "Description": "The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-08 Security Validation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "DEV-08.01AC", + "Description": "The changes to system components of the cloud service in the production environment are monitored to enforce the role and rights concept. Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-08 Security Validation", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-09.01B", + "Description": "The cloud service provider uses a version control system. The configuration of the system ensures that the confidentiality, integrity and authenticity of the source code is adequately protected at all stages of development.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-09 Version Control", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-09.02B", + "Description": "Version control procedures are set up to track dependencies of individual changes, with an attribution of changes to individual contributors, and to restore affected system components back to their previous state as a result of errors or identified vulnerabilities.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-09 Security Deployment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-09.03B", + "Description": "Version control covers all internally and externally developed software, configurations and third party commercial products under the responsibility of the cloud service provider.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-09 Security Deployment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-09.01AC", + "Description": "Version control procedures provide appropriate safeguards to ensure that the integrity and availability of cloud service customer data is not compromised when system components are restored back to their previous state.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-09 Security Deployment", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-09.02AC", + "Description": "The cloud service provider retains a history of the software versions and of the systems that are implemented in order to be able to reconstitute, where applicable in a test environment, a similar environment such as was implemented. The retention time for this history is risk-based (cf. OIS-07) defined in the policy for version control and aligned to the support life cycle of the cloud service.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-09 Security Deployment", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-10.01B", + "Description": "Authorised personnel or system components of the cloud service provider approve changes to the cloud service based on defined criteria (e.g. test results and required approvals) before these are made available to the cloud service customers in the production environment.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-10 Approvals for Provision in the Production Environment", + "Type": "Basic", + "AboutCriteria": "The definitions for criterion DEV-03 apply.", + "ComplementaryCriteria": "Where changes are to be approved by the cloud service customers in accordance with the contractual agreements before they are made available in the production environment, the cloud service customers ensure through suitable controls that authorised and qualified personnel receives the information made available, assesses the impact on the ISMS framework and decides on the approval in accordance with the conditions specified by the cloud service provider." + } + ], + "Checks": [] + }, + { + "Id": "DEV-10.02B", + "Description": "Cloud service customers are involved in the release according to contractual agreements.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-10 Security Maintenance", + "Type": "Basic", + "AboutCriteria": "If the contractual agreements do not foresee customer involvement of the approval, this should be clearly stated in the contractual agreements in order to fulfill this criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-10.01AC", + "Description": "The approval processes is monitored. Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-10 Security Maintenance", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-11.01B", + "Description": "Development and test environments under the responsibility of the cloud service provider undergo a risk assesssment and are protected with appropriate security measures. This includes identifying potential risks and implementing safeguards to ensure the security of these environments.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-11 Protection of Development and Test Environments", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-11.02B", + "Description": "The cloud service provider includes the development environment as part of the backup plan in accordance with the backup concept (cf. OPS-06).", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-11 Security Updates", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "DEV-12.01B", + "Description": "Production environments are physically or logically separated from test or development environments to prevent unauthorised access to cloud service customer data, the spread of malware, or unintended changes to system components. Data contained in the production environments is not used in test or development environments, unless explicitly requested by cloud service customers, in order not to compromise their confidentiality.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-12 Separation of Environments", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-12.02B", + "Description": "Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and non-production environments is documented and justified in accordance with the process for handling exceptions (cf. SP-03) and the risk management procedures (cf. OIS-07).", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-12 Security Documentation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "apikeys_key_rotated_in_90_days" + ] + }, + { + "Id": "DEV-13.01B", + "Description": "The cloud service provider ensures that, as part of the software development process, a Software Bill of Materials (SBOM) is created, maintained, and kept up-to-date for every developed or integrated software component. The structure, content, and management of Software Bills of Materials (SBOMs) should align with state-of-the-art concepts.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-13 Transparency about Software Components", + "Type": "Basic", + "AboutCriteria": "The state-of-the-art regarding the creation, maintenance, and utilisation of SBOMs, including their components and formats, is described in the current version of the BSI Technical Guideline TR-03183-2. Automated tools for generating, maintaining, and validating SBOMs are recommended to ensure accuracy and integration into security and vulnerability management processes.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-14.01B", + "Description": "The cloud service provider maintains a list of dependencies to hardware and software (cf. DEV-13) products used in the development of the cloud service.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-14 Development Service Organisations Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-14.02B", + "Description": "Policies and instructions for the use of third party and open source software are documented, communicated and provided in accordance with SP-01.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-14 Security Compliance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-14.03B", + "Description": "Third party software is retrieved only from trusted sources and authenticity is verified whenever possible.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-14 Security Compliance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-14.02AC", + "Description": "In procurement for the development of the cloud service, the cloud service provider performs a risk assessment in accordance with OIS-07 for every hardware and software product.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-14 Security Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-15.01B", + "Description": "The cloud service provider implements a procedure for the management of exceptions, including emergencies, in the change management process. This procedure aligns with the requirements of SP-03, ensuring that all exceptions to the standard change management process go through the OIS-07 risk management process and are incorporated in the risk handling measures described in OIS-08.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-15 Exceptions to the Change Management Process", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "DEV-16.01B", + "Description": "The cloud service provider conducts risk assessments within the procurement and development lifecycle of system components of the cloud service and implements processes to manage the identified risks. These processes include the following aspects: - Definition of security requirements that apply to the system components;- Implementation of security updates during the entire lifecycle of the system components and plans for their replacement after the end of the support period;- Documentation of all system components;- Description of the cybersecurity features and configurations for secure operations for all system components; and- Validation of the adherence to applicable security requirements for all system components.", + "Attributes": [ + { + "Section": "Procurement, Development and Modification of Information Systems (DEV)", + "SubSection": "DEV-16 Risk Assessments During the Development/Procurement of System Components", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-01.01B", + "Description": "Policies and instructions for controlling and monitoring service organisations (e.g. suppliers, vendors or other third parties) whose services contribute to the development or operation of the cloud service are documented, communicated and provided in accordance with SP-01 with respect to the following aspects: - Requirements for the assessment of risks resulting from the procurement of third party services;- Requirements for the classification of service organisations based on the risk assessment by the cloud service provider and the determination of whether the service organisation is a subservice organisation;- Information security requirements for the processing, storage or transmission of information by service organisations based on recognised industry standards, and under consideration of the criteria in this catalogue;- Information security awareness and training requirements for staff;- Applicable legal and regulatory requirements;- Requirements for dealing with vulnerabilities, security incidents and malfunctions;- Specifications for the contractual agreement of these requirements;- Specifications for the monitoring of these requirements; and- Specifications for applying these requirements also to subservice organisations used by the service organisations, insofar as the services provided by these subservice organisations also contribute to the development or operation of the cloud service.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-01 Policies and Instructions for Controlling and Monitoring Service Organisations", + "Type": "Basic", + "AboutCriteria": "The basic criterion applies to all service organisations of the cloud service provider, regardless of applying the 'inclusive' or 'carve-out method'. The additional criterion applies only to those of the service organisations that are considered to be subservice organisations. See section 'Consideration of Subservice Organisations'. Reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright. If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subservice organisations, these regulations remain unaffected by the C5 criteria.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-01.01AC", + "Description": "Subservice organisations of the cloud service provider are contractually obliged to provide regular reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control system that allow the cloud service provider to determine whether the subservice organisation designed and operated controls that are commensurate with the expected complementary subservice organisation controls (CSOC).", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-01 Supplier Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "The basic criterion applies to all service organisations of the cloud service provider, regardless of applying the 'inclusive' or 'carve-out method'. The additional criterion applies only to those of the service organisations that are considered to be subservice organisations. See section 'Consideration of Subservice Organisations'. Reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright. If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subservice organisations, these regulations remain unaffected by the C5 criteria.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-01.02AC", + "Description": "In case no such reports can be provided, the cloud service provider agrees appropriate information and audit rights to assess the design and operations of the service-related system of internal control regarding the expected CSOC.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-01 Supplier Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-02.01B", + "Description": "Service organisations of the cloud service provider undergo a risk assessment in accordance with the policies and instructions for the control and monitoring of service organisations prior to contributing to the development or operation of the cloud service. The risk assessment includes the identification, analysis, evaluation, treatment and documentation of risks with regard to the following aspects: - Protection needs regarding the confidentiality, integrity, availability and authenticity of cloud service customer data, cloud service derived data, cloud service provider data and account data processed, stored or transmitted by the third party;- Impact of a protection breach on the provision of the cloud service;- The cloud service provider's dependence on the service organisation for the scope, complexity and uniqueness of the provided service, including the consideration of possible alternatives;- Complementary subservice organisation controls (CSOCs) assumed in the design of cloud service provider's controls to meet the applicable C5 criteria;- Deviations regarding the design and operation of CSOCs assumed at service organisations considered as subservice organisations and mitigating measures by the cloud service provider to address such deviations; and- The ability of the cloud service provider to diversify sources of supply and limit vendor lock-in.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-02 Risk Assessment of Service Organisations", + "Type": "Basic", + "AboutCriteria": "For assessing risks with service organisations, the cloud service provider can perform coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products provided by service organisations. Apart from the aspects listed in SSO-02 Basic Criterion such a risk assessment should take into account technical and, where relevant, non-technical risk factors.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-02.02B", + "Description": "The adequacy of the risk assessment is reviewed regularly, at least annually, by qualified personnel of the cloud service provider during service usage.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-02 Supplier Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-02.01AC", + "Description": "If the cloud service provider relies on assets from a supplier or on services from subservice organisations to operate the cloud service, the cloud service provider does not allow those suppliers or service organisations to access any cloud service customer data, cloud service derived data or account data, unless it is ensured that all operations requiring access to those data types are performed or supervised by personnel who have been authorised (cf. HR-01).", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-02 Supplier Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-03.01B", + "Description": "If the cloud service provider relies on assets from a supplier or on services from subservice organisations to operate the cloud service, the cloud service provider does not allow those suppliers or service organisations to access any cloud service customer data, cloud service derived data or account data, unless they have performed a risk assessment according to OIS-07 on the possible exposure of cloud service customer data, cloud service derived data or account data.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-03 Data Processing of Service Organisations", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-03.02B", + "Description": "The cloud service provider obtains written authorisation of the customer prior to the processing of cloud service customer data, cloud service derived data or account data when engaging service organisations. This can be achieved by authorisation of the customer, per service organisation, or by way of a general pre-authorisation between the cloud service provider and the customer.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-03 Supplier Monitoring", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-04.01B", + "Description": "The cloud service provider maintains a directory for controlling and monitoring the service organisations who contribute services to the delivery of the cloud service. The following information is maintained in the directory: - Company name;- Address;- Locations of the processing and storage of cloud service customer data, cloud service derived data, cloud service provider data and account data;- Responsible contact group/person at the service organisation;- Responsible contact group/person at the cloud service provider;- Description of the service;- Classification based on the risk assessment;- Beginning of service usage; and- Proof of compliance with contractually agreed requirements.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-04 Directory of Service Organisations", + "Type": "Basic", + "AboutCriteria": "It is not necessary to maintain a single central register in order to fulfil the basic criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-04.02B", + "Description": "The inventory is reviewed at least annually for completeness, accuracy and validity of the information.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-04 Supplier Assessment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.01B", + "Description": "The cloud service provider monitors compliance with information security requirements and applicable legal and regulatory requirements in accordance with policies and instructions concerning controlling and monitoring of service organisation.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Monitoring of Compliance with Requirements", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.02B", + "Description": "Monitoring includes a regular review of the following information to the extent that such information is to be provided by service organisations in accordance with the contractual agreements: - Reports on the quality of the service provided;- Certificates of the management systems' compliance with international standards;- Independent third party reports on the design and operation of their service-related system of internal control; and- Records of the service organisations on the handling of vulnerabilities, security incidents and malfunctions.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.03B", + "Description": "The frequency of the monitoring corresponds to the classification of the service organisation based on the risk assessment conducted by the cloud service provider (cf. SSO-02).", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.04B", + "Description": "If a service organisation is considered to be a subservice organisation, the following applies:- The cloud service provider assesses this relationship and carries out appropriate procedures;- These procedures provide reasonable assurance that the subservice organization has designed and operated relevant controls;- The subservice organizations controls correspond to the expected complementary subservice organization controls (CSOCs) assumed in the design of the cloud service providers controls; and- This ensures that the applicable C5 criteria are met.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.05B", + "Description": "Identified deviations are subjected to analysis, evaluation and treatment in accordance with the risk assessment of service organisations (cf. SSO-02).", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.06B", + "Description": "When a change in a third party contributing to the provision of the cloud service significantly adversely affects its level of security, the cloud service provider informs all of its cloud service customers without undue delay.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.07B", + "Description": "The cloud service provider establishes and documents a procedure to regularly review non-disclosure or confidentiality requirements for all suppliers involved in providing the cloud service. This procedure is implemented in practice, and the review is conducted at least once per year.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Basic", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.01AC", + "Description": "The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects: - Configuration of system components;- Performance and availability of system components;- Response time to malfunctions and security incidents; and- Recovery time (time until completion of error handling).", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "SSO-05.02AC", + "Description": "Identified violations and discrepancies are automatically reported to the responsible personnel or system components of the cloud service provider for prompt assessment and action.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-05.03AC", + "Description": "The cloud service provider defines and implements a process for conducting periodic security assessments for all third parties. The nature and scope of these security assessments correspond to the risk associated with each third party. These risk-based security assessments ensure that third parties meet the required security standards and that any potential risks are identified and mitigated appropriately.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-05 Supplier Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5. If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions: - The scope and the validity respectively the period covered by the report;- Modifications of the opinion, deviations/exceptions noted and management's response thereon;- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and- Stated security incidents. Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, see section \"Consideration of Subservice Organisations\"\"). Appropriate procedures may comprise the review of independent third party reports", + "ComplementaryCriteria": "or audit procedures performed by the cloud service provider at the subservice organisation." + } + ], + "Checks": [] + }, + { + "Id": "SSO-06.01B", + "Description": "The cloud service provider has defined and documented contract termination or exit strategies for the purchase of services where the risk assessment of the service organisations regarding the scope, complexity and uniqueness of the service provided resulted in a very high dependency (cf. Supplementary Information).", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-06 Contract Termination Strategy for Service Organisations", + "Type": "Basic", + "AboutCriteria": "A very high dependency can be assumed in particular if the purchased service is indispensable for the provision of the cloud service. This situation is the case if the cloud service provider: - Provides the cloud service from data centres operated by service organisations; or- Provides a SaaS service and uses the IaaS or PaaS of another cloud service provider. A very high dependency can also be assumed if the service cannot be obtained within one month from an alternative service organisation, as: - It is unique on the market and no other service organisation can deliver it;- It is strongly individualised by the service organisation and/or the cloud service provider;- It cannot be supplied by any other service organisation in the required quality of service; or- It requires specific knowledge that is only/mainly available to the current service organisation and not to the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-06.02B", + "Description": "Exit strategies are aligned with operational continuity plans and include the following aspects: - Analysis of the potential costs, impacts, resources and timing of the transition of a purchased service to an alternative service organisation;- Definition and allocation of roles, responsibilities and sufficient resources to perform the activities for a transition;- Definition of success criteria for the transition; and- Definition of indicators for monitoring the performance of services, which should initiate the withdrawal from the service if the results are unacceptable.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-06 Supplier Risk Management", + "Type": "Basic", + "AboutCriteria": "A very high dependency can be assumed in particular if the purchased service is indispensable for the provision of the cloud service. This situation is the case if the cloud service provider: - Provides the cloud service from data centres operated by service organisations; or- Provides a SaaS service and uses the IaaS or PaaS of another cloud service provider. A very high dependency can also be assumed if the service cannot be obtained within one month from an alternative service organisation, as: - It is unique on the market and no other service organisation can deliver it;- It is strongly individualised by the service organisation and/or the cloud service provider;- It cannot be supplied by any other service organisation in the required quality of service; or- It requires specific knowledge that is only/mainly available to the current service organisation and not to the cloud service provider.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-07.01B", + "Description": "Policies and instructions are defined to ensure transparency within service organisations of the cloud service provider with respect to the following aspects: - Data flow and interfaces between the cloud service provider and third parties are documented, including measures regarding the secure transmission and access control for data shared with third parties;- It is identified whether third parties used by the cloud service provider itself rely on service providers that contribute to the provisioning of the cloud service;- If third parties rely on service providers, the types of data processed by the service providers are identified and risks related to the subcontracting of services are assessed (cf. SSO-02).- If third parties rely on service providers, require the third parties to monitor the compliance of their service providers with relevant contractual, legal and regulatory requirements (cf. SSO-05); and- Cloud service customers are informed of third parties and their service providers in use for provisioning the cloud service (both types being considered as subservice organisations of the cloud service provider) and what type of data these subservice organisations are processing.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-07 Ensuring Transparency within Service Organisations", + "Type": "Basic", + "AboutCriteria": "Monitoring of third parties can occur via audits, certifications and third party reports (cf. SSO-05) and may be performed by the subcontracting third party. The cloud service provider remains responsible for reviewing the results of compliance monitoring and assessing the risk.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-07.02B", + "Description": "The cloud service provider documents this information and reviews its completeness, accuracy and validity at least annually.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-07 Supplier Governance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SSO-08.01B", + "Description": "When a functional component is used to provide the cloud service, and may have access, directly or indirectly, to cloud service customer data, the cloud service provider defines and implements: - A policy according to SP-01 that does not allow such a component to exchange directly with its supplier;- Instructions according to SP-01 for the cloud service provider to authorise any content provided by the supplier for its functional components before transferring the content to the functional components (for each transfer);- Instructions according to SP-01 for the cloud service provider to authorise any content to be sent from a functional component to its supplier before transferring the content to the supplier (for each transfer); and- When a procedure to authorise content transfers is automated, then the Cloud Serivce Provider implements this procedure using a solution that keeps traces of the operations proposed by the supplier of the functional component, of the verification performed to authorise the content and of the incoming and outgoing transfers effectively performed.", + "Attributes": [ + { + "Section": "Control and Monitoring of Service Providers and Suppliers (SSO)", + "SubSection": "SSO-08 Controlling Exchanges with Suppliers of Functional Components", + "Type": "Basic", + "AboutCriteria": "A supplier of a functional component is typically a service organisation of the cloud service provider. The authorisation for the transfer may be automated. Content provided by the supplier refers to updates of the functional components.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-01.01B", + "Description": "Policies and instructions with technical and organisational safeguards are documented, communicated and provided in accordance with SP-01 to ensure a fast, effective and proper response to all known security incidents.The cloud service provider defines guidelines for the classification, prioritisation, escalation and root cause analysis of security incidents and creates interfaces to the incident management and business continuity management.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-01 Policy for Security Incident Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and that these notifications are forwarded in a timely manner to the responsible departments for handling so that an appropriate response can be triggered." + } + ], + "Checks": [] + }, + { + "Id": "SIM-01.02B", + "Description": "The cloud service provider has set up a 'Computer Emergency Response Team' (CERT), which contributes to the coordinated resolution of occurring security incidents.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-01 Security Incident Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-01.03B", + "Description": "Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-01 Security Incident Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_organization_essential_contacts_configured" + ] + }, + { + "Id": "SIM-01.01AC", + "Description": "There are instructions as to how the data of a suspicious system can be collected in a conclusive manner in the event of a security incident.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-01 Security Incident Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-01.02AC", + "Description": "In addition, there are analysis plans for typical security incidents and an evaluation methodology which ensures the collected information does not lose its evidential value in any subsequent legal assessment.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-01 Security Incident Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_sink_created" + ] + }, + { + "Id": "SIM-02.01B", + "Description": "The cloud service provider has documented, approved and communicated one or more security incident response plans. The plans address all stages of incident response, including identification, containment, eradication, recovery, and lessons learned. They are approved by subject matter experts of the cloud service provider and communicated to all relevant stakeholders.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-02 Security Incident Response Plans", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-02.02B", + "Description": "The plans are evaluated and updated at least annually or as necessary to reflect changes in the organisational structure or environment.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-02 Incident Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.01B", + "Description": "Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Processing of Security Incidents", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ] + }, + { + "Id": "SIM-03.02B", + "Description": "If the cloud service provider determines the need for external assistance, it selects a competent and trustworthy incident response service provider or one that is recommended by a national cybersecurity authority.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.03B", + "Description": "The cloud service provider maintains a catalogue that clearly identifies the information security incidents that affect cloud service customer data and uses that catalogue to classify information security incidents.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.04B", + "Description": "The incident classification mechanism includes provisions to correlate information security events. In addition, these correlated information security events are themselves assessed and classified according to their criticality.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.05B", + "Description": "The results of these root-cause analyses are documented, shared with relevant stakeholders, and used as part of evaluation and learning processes.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.06B", + "Description": "All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service are implemented in accordance with criticality levels and legal requirements.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_sink_created" + ] + }, + { + "Id": "SIM-03.07B", + "Description": "The analysis process also ensures traceability of the entire kill chain of a security incident.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Basic", + "AboutCriteria": "The term 'kill chain' refers to the stages an attacker goes through to carry out a cyberattack, leading to a security incident. Understanding and ensuring traceability of the entire kill chain helps the cloud service provider identify weaknesses in their security posture and enhance defenses.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "logging_sink_created" + ] + }, + { + "Id": "SIM-03.01AC", + "Description": "The cloud service provider simulates the identification, analysis and defence of security incidents and attacks at least once a year through appropriate tests and exercises (e.g. Red Team training).", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.02AC", + "Description": "The cloud service provider establishes, or contracts for the services of, an integrated team of forensic/incident responder personnel specifically trained on evidence preservation and chain of custody management.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-03.03AC", + "Description": "The cloud service provider monitors the handling of information security incidents to verify the application of incident management policies and procedures. Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-03 Incident Communication", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-04.01B", + "Description": "After a security incident has been processed, the solution is documented in accordance with the contractual agreements and the report is sent to the affected customers for final acknowledgement or, if applicable, as confirmation.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-04 Documentation and Reporting of Security Incidents", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and their resolution and that these notifications are forwarded promptly to the entity responsible for handling them so that an appropriate response can be made." + } + ], + "Checks": [] + }, + { + "Id": "SIM-04.01AC", + "Description": "The customer can either actively approve solutions or the solution is automatically approved after a certain period.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-04 Incident Recovery", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-04.02AC", + "Description": "Information on security incidents or confirmed security breaches is made available to all affected customers.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-04 Incident Recovery", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-04.03AC", + "Description": "The contract between the cloud service provider and the cloud service customer regulates which data is made available to the cloud service customer for his own analysis in the event of security incidents.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-04 Incident Recovery", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-05.01B", + "Description": "The cloud service provider informs employees and external business partners of their obligations. If necessary, they agree to or are contractually obliged to report all security events that become known to them and are directly related to the cloud service provided by the cloud service provider to a previously designated central office of the cloud service provider promptly.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-05 Duty of the Employees to Report Security Incidents to a Central Body", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that identified security events, which the cloud service provider is required to process, are communicated promptly to previously designated, responsible personnel. The identification of such security events is supported by suitable controls (cf. complementary criterion for OPS-10)." + } + ], + "Checks": [] + }, + { + "Id": "SIM-05.02B", + "Description": "The cloud service provider communicates that 'false reports' of events that do not subsequently turn out to be incidents do not have any negative consequences.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-05 Incident Analysis", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-05.03B", + "Description": "The cloud service provider makes the information security incident reporting mechanisms known as part of its communication to employees, cloud service customers and external business partners.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-05 Incident Analysis", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-06.01B", + "Description": "Mechanisms are in place to measure and monitor the type and scope of security incidents and to report them to support agencies. The information obtained from the evaluation is used to identify recurrent or significant incidents and to identify the need for further protection.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-06 Evaluation and Learning Process", + "Type": "Basic", + "AboutCriteria": "Supporting bodies may be external service providers or government agencies such as the BSI.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they include into their ISMS the findings and measures related to previous security incidents reported by the cloud service provider. The cloud service customers evaluate whether and which supporting measures they might take on their side." + } + ], + "Checks": [] + }, + { + "Id": "SIM-06.02B", + "Description": "The evaluation and learning process includes the results of root-cause analyses conducted in accordance with SIM-02.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-06 Incident Reporting", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-06.03B", + "Description": "The cloud service provider defines, implements and maintains a knowledge repository of security incidents and the measures taken to solve them, as well as information related to the assets that these security incidents affected and uses that information to enrich the classification catalogue of incidents (cf. SIM-03).", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-06 Incident Reporting", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "SIM-06.04B", + "Description": "The intelligence gained from the incident management and gathered in the knowledge repository is used to identify recurring security events or incidents, or potential significant security incidents, to determine the need for advanced safeguards, and implement them.", + "Attributes": [ + { + "Section": "Security Incident Management (SIM)", + "SubSection": "SIM-06 Incident Reporting", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-01.01B", + "Description": "The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-01 Business Continuity and Emergency Management System", + "Type": "Basic", + "AboutCriteria": "The basic criterion can (but need not) be fulfilled with a certification of the BCM according to ISO/IEC 22301", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-01.02B", + "Description": "Policies and instructions for establishing the strategy and guidelines to ensure business continuity management for the cloud service are documented, communicated and provided in accordance with SP-01.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-01 Business Continuity Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "BCM-01.03B", + "Description": "The top management (or a member of the top management) of the cloud service provider is named as the process owner of business continuity and emergency management and is responsible for establishing the process within the company as well as ensuring compliance with the guidelines. They must ensure that sufficient resources are made available for an effective process.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-01 Business Continuity Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-01.04B", + "Description": "People in management and other relevant leadership positions demonstrate leadership and commitment to this issue by encouraging employees to actively contribute to the effectiveness of continuity and emergency management.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-01 Business Continuity Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-01.05B", + "Description": "Policies and instructions related to business impact analyses and business continuity plans are documented, communicated and made available in accordance with SP-01.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-01 Business Continuity Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_automated_backups" + ] + }, + { + "Id": "BCM-02.01B", + "Description": "The policies and instructions for business continuity management for the cloud service include the need to perform a business impact analysis. The cloud service provider analyses the impact of disrupting activities to its organisation with respect the development and operations of the cloud service in accordance with applicable policies and instructions with at least the following aspects: - Possible scenarios based on a risk analysis that includes cyber risks;- Identification of critical products and services;- Identification of dependencies, including processes (including resources required), applications, business partners and third parties;- Capturing threats to critical products and services;- Identification of effects resulting from planned and unplanned malfunctions and changes over time;- Determination of the maximum tolerable period of downtime and service degregation;- Identification of restoration priorities;- Determination of time targets for the resumption of critical products and services within the maximum acceptable time period (i.e. RTO);- Determination of time targets for the maximum reasonable period during which cloud service derived data, cloud service provider data, account data and, if its processing is contractually agreed upon, cloud service customer data can be lost and not recovered (i.e. RPO); and- Estimation of the resources needed for resumption.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-02 Business Impact Analysis", + "Type": "Basic", + "AboutCriteria": "Scenarios to be considered according to the basic criterion are, for example, the loss of personnel, buildings, infrastructure and service providers.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the scenarios for a failure of the cloud service or the cloud service provider are sufficiently considered in the context of their business impact analysis." + } + ], + "Checks": [] + }, + { + "Id": "BCM-02.02B", + "Description": "The business impact analysis resulting from the applicable policies and instructions is reviewed at regular intervals, at least once a year, or after significant organisational or environment-related changes.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-02 Business Impact Analysis", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-03.01B", + "Description": "Based on the results of the business impact analysis, business continuity plans are documented in a consistent manner, and in accordance with applicable policies and instructions. Business continuity plans take the following aspects into account: - Defined purpose and scope with consideration of the relevant dependencies;- Accessibility and comprehensibility of the plans for persons who are to act accordingly;- Ownership by at least one designated person responsible for review, updating and approval;- Defined communication channels, roles and responsibilities including notification of the customer;- Recovery procedures, manual interim solutions and reference information (taking into account prioritisation in the recovery of cloud infrastructure components and services and alignment with customers);- Methods for putting the plans into effect;- Continuous process improvement;- Consistency over all locations, zones, regions and partitions; and- Interfaces to Security Incident Management.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-03 Business Continuity Plans", + "Type": "Basic", + "AboutCriteria": "Although different partitions do not share a common IAM (and hence no common personnel for BCM), business continuity plans may be shared between different partitions since the same cloud services are provided.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the results of their business impact analysis are sufficiently considered when planning the operational continuity and the business plan in order to provide for the effects of a failure of the cloud service or cloud service provider. Cloud service customers ensure through suitable controls that the availability of the cloud service, its recovery time according to the BCM plan and the data loss of the cloud service are consistent with their own availability requirements and tolerable data loss." + } + ], + "Checks": [] + }, + { + "Id": "BCM-03.02B", + "Description": "The business continuity plans are reviewed at regular intervals, at least once a year, or after significant organisational or environment-related changes.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-03 Business Continuity Planning", + "Type": "Basic", + "AboutCriteria": "Although different partitions do not share a common IAM (and hence no common personnel for BCM), business continuity plans may be shared between different partitions since the same cloud services are provided.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-04.01B", + "Description": "Business continuity plans are tested on a regular basis (at least annually) or after significant organisational or environmental changes. Tests involve affected cloud service customers and relevant third parties (e.g. service organisations).", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-04 Testing Business Continuity", + "Type": "Basic", + "AboutCriteria": "Tests are primarily conducted at the operational level and are aimed at operational target groups. Tests include e.g.: - Test of technical precautionary measures;- Functional tests; and- Plan review. Exercises also take place on a tactical and strategic level. These include e.g.: - Plan meeting;- Staff exercise;- Command post exercise;- Communication and alerting exercise;- Simulation of scenarios; and- Emergency or full exercise. Relevant third parties are in particular service organisations of the cloud service provider who contribute to the development or operation of the cloud service (cf. basic criteria SSO-02 and SSO-06).", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that measures to prevent the impact of a cloud service or cloud service provider outage are regularly reviewed, updated, tested and exercised. The cloud service provider is involved in the tests and exercises in accordance with the contractual agreements. Cloud service customers ensure through suitable controls that the results of the cloud service provider's BCM tests and exercises are incorporated into their own BCM and that they are fully appreciated with regard to ensuring the customer's operational continuity. In tests and exercises that involve the customer and therefore require own measures on the customer side, cloud service customers ensure that the appropriate measures for coping with the scenario are practiced and tested by means of suitable BCM controls." + } + ], + "Checks": [] + }, + { + "Id": "BCM-04.02B", + "Description": "The tests are documented and results are taken into account to review the business continuity plans and for future business continuity measures.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-04 Business Continuity Testing", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-04.01AC", + "Description": "In addition to the tests, exercises are also carried out which, among other things, have resulted in scenarios from security incidents that have already occurred in the past.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-04 Business Continuity Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "Tests are primarily conducted at the operational level and are aimed at operational target groups. Tests include e.g.: - Test of technical precautionary measures;- Functional tests; and- Plan review. Exercises also take place on a tactical and strategic level. These include e.g.: - Plan meeting;- Staff exercise;- Command post exercise;- Communication and alerting exercise;- Simulation of scenarios; and- Emergency or full exercise. Relevant third parties are in particular service organisations of the cloud service provider who contribute to the development or operation of the cloud service (cf. basic criteria SSO-02 and SSO-06).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-04.02AC", + "Description": "The cloud service provider has procedures in place to ensure that cloud service customers are timely informed about planned activities related to business continuity tests and exercises that could affect the information security of the cloud service (e.g. regarding its availability). This information includes the scheduled timeframe for the operations as well as a description of the work to be carried out.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-04 Business Continuity Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-04.03AC", + "Description": "The cloud service provider provide cloud service customers an assessment of the potential impacts concerning the information security of the cloud service and with details for contacting the cloud service provider.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-04 Business Continuity Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-04.04AC", + "Description": "After a completed exercise, the existing alarm plan is reviewed and (if needed) adapted.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-04 Business Continuity Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "BCM-05.01B", + "Description": "Policies and instructions for Business Continuity Management (BCM) are documented, communicated and provided in accordance with SP-01 regarding the following aspects: - Goals of the BCM;- Roles and responsibilities, management commitment;- Scoping of the BCM, identifying relevant business processes;- Interfaces, in particular to Incident Management;- Communication with relevant entities and competent authorities;- Methodology;- Consideration of Risk;- Business Impact Analysis (BIA);- Business Continuity Plan (BCP);- Resource Planning (usually part of the BCP);- Testing of Business Continuity Plans and regular updates to BCM documentation; and- Continuous improvement of the Business Continuity Management.", + "Attributes": [ + { + "Section": "Business Continuity Management (BCM)", + "SubSection": "BCM-05 Policy for Business Continuity Management", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-01.01B", + "Description": "The legal, regulatory, self-imposed and contractual requirements relevant to the information security of the cloud service as well as the cloud service provider's procedures for complying with these requirements are explicitly defined and documented.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-01 Identification of Applicable Legal, Regulatory, Self-imposed or Contractual Requirements", + "Type": "Basic", + "AboutCriteria": "The cloud service provider's documentation may refer to the following requirements, among others: - Requirements for the protection of personal data (e.g. EU General Data Protection Regulation);- Compliance requirements based on contractual obligations with cloud service customers (e.g. ISO/IEC 27001, SOC 2, PCI-DSS);- Generally accepted accounting principles (e.g. in accordance with HGB or IFRS);- Requirements regarding access to data and auditability of digital documents (e.g. according to GDPdU); and- Other laws (e.g. according to BSIG or AktG). The documentation of the identified requirements and the procedures for complying with these requirements may be spread across several documents and does not necessarily have to be recorded in a single register or directory.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-01.01AC", + "Description": "The cloud service provider provides an overview or summary of the procedures described in the basic criterion when requested by a cloud service customer.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-01 Compliance Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-02.01B", + "Description": "The cloud service provider documents and implements an audit programme over three years that defines the scope and the frequency of the audits in accordance with the management of change, policies, and the results of the risk assessment (cf. OIS-07).", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-02 Policy for Planning and Conducting Audits", + "Type": "Basic", + "AboutCriteria": "An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. Audits may be performed as internal audits, sometimes called first party audits, that are conducted by, or on behalf of, the organisation itself. They may also be performed as external audits, generally called second and third party audits. Second party audits are conducted by parties having an interest in the organisation, such as customers, or by other individuals on their behalf. Third party audits are conducted by independent auditing organisations. An audit programme comprises arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose. It may comprise internal and external audits. COM-02 is fully applicable to virtual infrastructure and infrastructure as code. Audit activities might still impact operations in a virtual environment. Reviews of configurations might for example be performed as part of code reviews.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that appropriate responses are made to malfunctions of the cloud service through such audits. To the extent that contractually guaranteed information and audit rights exist, the cloud service customers ensure through suitable controls that these rights are designed and executed in accordance with their own requirements." + } + ], + "Checks": [] + }, + { + "Id": "COM-02.02B", + "Description": "Risk-based policies and instructions for planning and conducting audits that protect the operation of the cloud service from interference by audits are documented, communicated and made available in accordance with SP-01 and address the following aspects: - Restriction to read-only access to system components in accordance with the agreed audit plan and as necessary to perform the activities;- Activities that may result in malfunctions of the cloud service or breaches of contractual requirements are performed during scheduled maintenance windows or outside peak periods;- Logging and monitoring of activities;- Review of server and network equipment configurations under the responsibility of the cloud service provider;- Intrusion testing for external access points; and- Source code reviews of internally developed security functions.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-02 Legal and Regulatory Compliance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-02.01AC", + "Description": "The cloud service provider grants its cloud service customers contractually guaranteed information and audit rights. These rights may be exercised individually or as part of group audits.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-02 Legal and Regulatory Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.01B", + "Description": "Subject matter experts check the compliance of the information security management system at regular intervals, at least annually, with the relevant and applicable legal, regulatory, self-imposed or contractual requirements (cf. COM-01) through internal audits. This includes checks regarding: - Compliance with the policies and instructions (cf. SP-01) within their scope of responsibility (cf. OIS-01); and- Effectiveness of organisational and operational measures to manage the risks posed to the security of network and information systems (cf. OIS-07).", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Internal Audits of the Information Security Management System", + "Type": "Basic", + "AboutCriteria": "Subject matter experts operate, e.g., in the cloud service provider's internal revision department or expert third parties commissioned by the cloud service provider, such as auditing companies, and may hold relevant certifications such as 'Certified Internal Auditor (CIA)'. With regard to ISMS compliance, see Section 9.2 of ISO/IEC 27001, which outlines the requirements for conducting internal audits of an Information Security Management System (ISMS) and for establishing an internal audit program. When establishing the internal audit program(s), the cloud service provider should define the scope and criteria by considering the importance of the processes concerned and the results of previous audits. This approach allows cloud service providers to define the audit scope based on the criticality of complying with relevant legal, regulatory, or contractual requirements (cf. COM-01) and internal policies and instructions (cf. SP-01), without requiring a comprehensive review of all requirements during each audit cycle.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.02B", + "Description": "Subject matter experts conducting internal audits are not in the line of authority of the personnel of the area under review. If the size of the cloud service provider does not allow such separation of line of authority, alternative measures to guarantee the impartiality of compliance checks are put in place.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Audit and Assessment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.03B", + "Description": "Identified vulnerabilities and deviations are subject to risk assessment in accordance with the risk management procedure (cf. OIS-07) and follow-up measures are defined and tracked (cf. OPS-18).", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Audit and Assessment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.04B", + "Description": "The cloud service provider documents specifically deviations that are non-conformities from the applicable legal, regulatory, self-imposed and contractual requirements relevant to the information security of the cloud service, including an assessment of their severity, and keeps track of their remediation.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Audit and Assessment", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.01AC", + "Description": "Internal audits are supplemented by procedures to automatically monitor applicable requirements of policies and instructions with regard to the following aspects: - Configuration of system components to provide the cloud service within the cloud service provider's area of responsibility;- Performance and availability of these system components;- Response time to malfunctions and security incidents; and- Recovery time (time to completion of error handling).", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Audit and Assessment", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.02AC", + "Description": "Identified vulnerabilities and deviations are automatically reported to the appropriate cloud service provider's subject matter experts for immediate assessment and action.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Audit and Assessment", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-03.03AC", + "Description": "The cloud service provider provides interfaces to cloud service customers so that they can check compliance with selected contractual agreements in real time.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-03 Audit and Assessment", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-04.01B", + "Description": "The top management of the cloud service provider is regularly informed about the information security performance within the scope of the ISMS in order to ensure its continued suitability, adequacy and effectiveness. The information is included in the management review of the ISMS. This management review ist performed at least once a year", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-04 Information on Information Security Performance and Management Assessment of the ISMS", + "Type": "Basic", + "AboutCriteria": "The top management is a natural person or group of people who take final decisions for the institution and are accountable for these. The aspects to be dealt with in the management review of the ISMS are listed in Section 9.3 of ISO / IEC 27001.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "COM-04.01AC", + "Description": "The cloud service provider defines and implements technical and operational metrics that align with the organisation's business objectives, security requirements, and compliance obligations. These metrics are documented and included in the management review of the ISMS to ensure their continued suitability, adequacy, and effectiveness.", + "Attributes": [ + { + "Section": "Compliance (COM)", + "SubSection": "COM-04 Internal Controls", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "INQ-01.01B", + "Description": "Investigation requests from government agencies for cloud service customer data, cloud service derived data and account data are subject to a documented legal assessment by subject matter experts of the cloud service provider. The assessment determines whether the government agency has an applicable and legally valid legal basis and what further steps need to be taken for the given request.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-01 Legal Assessment of Investigative Requests", + "Type": "Basic", + "AboutCriteria": "For evidence purposes, all requests that were completely processed during the specified period shall form the population for testing the operating effectiveness of controls to meet the criteria in this domain. All requests are to be included in the population, irrespective of whether they resulted in cloud service customer data or cloud service derived data being disclosed.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the type and scope of government investigation requests and the associated disclosure of their own data has been dealt with in their own risk management and that the use of the cloud service is only taken up or continued when this risk has been deemed acceptable." + } + ], + "Checks": [] + }, + { + "Id": "INQ-02.01B", + "Description": "The cloud service provider informs the affected cloud service customer(s) without undue delay. Exceptions for this information of the customer need to be justified by the legal basis of this request or because there are clear indications of illegal actions of the customer in connection with the use of the cloud service.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-02 Informing Cloud Service Customers about Investigation Requests", + "Type": "Basic", + "AboutCriteria": "This does not affect other legal or regulatory requirements that requires earlier information for cloud service customers.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that such notifications are received and legally checked according to their own specifications and possibilities." + } + ], + "Checks": [ + "iam_organization_essential_contacts_configured" + ] + }, + { + "Id": "INQ-03.01B", + "Description": "Access to or disclosure of cloud service customer data, cloud service derived data or account data in response to government investigation requests is only permitted if the cloud service provider has performed a legal assessment. This assessment has to confirm that there is an applicable and valid legal basis and that the request must be granted according to this basis.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-03 Conditions for Access to or Disclosure of Data in Investigation Requests", + "Type": "Basic", + "AboutCriteria": "Disclosure of cloud service customer data to government agencies may include handing over encryption keys. The disclosure of keys should also be scrutinised in accordance with the INQ criteria. In particular, with reference to INQ-04, care should be taken to ensure that no other cloud service customer data is compromised by handing over a key.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "INQ-04.01B", + "Description": "The cloud service provider's procedures for granting access to or disclosing cloud service customer data and cloud service derived data in the context of investigation requests from government agencies ensure that the agencies only gain access to or insight into the data that is the subject of the investigation request.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-04 Limiting Access to or Disclosure of Data in Investigation Requests", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "INQ-04.02B", + "Description": "If no clear limitation of the data is possible, the cloud service provider anonymises or pseudonymises the data so that government agencies can only assign it to those cloud service customers who are subject of the investigation request.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-04 Investigation Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "INQ-04.01AC", + "Description": "The cloud service provider monitors the access and activities performed by or on behalf of investigators as determined by the process described in INQ-01.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-04 Investigation Response", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_sink_created" + ] + }, + { + "Id": "INQ-04.02AC", + "Description": "Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-04 Investigation Response", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "INQ-05.01B", + "Description": "The cloud service provider documents the technical procedures and other relevant technical information regarding the provision or disclosure of cloud service customer data in response to valid investigative requests and provides it to cloud service customers.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-05 Communication of Technical Procedures for Data Disclosure in Investigation Requests", + "Type": "Basic", + "AboutCriteria": "The criterion is limited to cloud service customer data. The cloud service provider has typically access to other data types such as cloud service derived data and account data such that extending the criterion to those other data types, may not lead to useful information for customers risk management. Technical capabilities and limitations to access cloud service customer data include aspects such as: - If the cloud service customers stores its cloud service customer data in unencrypted form;- If the cloud service provider encrypts cloud service customer data in storage and transit;- Whether the cloud service provider has the ability to decrypt cloud service customer data in case of such requests and how this ability for access or disclosure is used;- Retention periods for cloud service derived data relating to the cloud service customer and whether such data is stored in encrypted form;- Possibilities for decrypting cloud service customer data or for extracting cloud service customer data during the decryption process;- Disclosure of user identities and credentials; and- Further measures that have been created or can be used for disclosing cloud service customer data.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they minimize potential disclosure of their customer data. According to the protection need of the cloud service customer data, the cloud service customer take the decision if the particular cloud service can be used or if the risk of disclosure is to high." + } + ], + "Checks": [] + }, + { + "Id": "INQ-05.02B", + "Description": "The type and scope of the provided information is based on the needs of the cloud service customers' expert personnel to assess risks to the cloud service customer's data confidentiality. At a minimum, the following aspects must be addressed: - The process for the provision and disclosure of cloud service customer data in response to legitimate investigative requests;- The technical capabilities and limitations of the cloud service provider regarding disclosure of cloud service customer data;- Logging mechanisms implemented to records access for disclosure of cloud service customer data;- Access possibilities for cloud service customers to review such logs;- Methods for accessing and disclosing cloud service customer data; and- Laws, regulations, or other legal means and their applicability concerning the cloud service provider's ability to inform its customers about the provision and disclosure of cloud service customer data.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-05 Legal Cooperation", + "Type": "Basic", + "AboutCriteria": "The criterion is limited to cloud service customer data. The cloud service provider has typically access to other data types such as cloud service derived data and account data such that extending the criterion to those other data types, may not lead to useful information for customers risk management. Technical capabilities and limitations to access cloud service customer data include aspects such as: - If the cloud service customers stores its cloud service customer data in unencrypted form;- If the cloud service provider encrypts cloud service customer data in storage and transit;- Whether the cloud service provider has the ability to decrypt cloud service customer data in case of such requests and how this ability for access or disclosure is used;- Retention periods for cloud service derived data relating to the cloud service customer and whether such data is stored in encrypted form;- Possibilities for decrypting cloud service customer data or for extracting cloud service customer data during the decryption process;- Disclosure of user identities and credentials; and- Further measures that have been created or can be used for disclosing cloud service customer data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "INQ-05.03B", + "Description": "The document is maintained in accordance with SP-01 and aligned with the cloud service provider's guidelines on minimising access to cloud service customer data (cf. DEV-01) to ensure its relevance and accuracy for cloud service customers.", + "Attributes": [ + { + "Section": "Dealing with Investigation Requests from Government Agencies (INQ)", + "SubSection": "INQ-05 Legal Cooperation", + "Type": "Basic", + "AboutCriteria": "The criterion is limited to cloud service customer data. The cloud service provider has typically access to other data types such as cloud service derived data and account data such that extending the criterion to those other data types, may not lead to useful information for customers risk management. Technical capabilities and limitations to access cloud service customer data include aspects such as: - If the cloud service customers stores its cloud service customer data in unencrypted form;- If the cloud service provider encrypts cloud service customer data in storage and transit;- Whether the cloud service provider has the ability to decrypt cloud service customer data in case of such requests and how this ability for access or disclosure is used;- Retention periods for cloud service derived data relating to the cloud service customer and whether such data is stored in encrypted form;- Possibilities for decrypting cloud service customer data or for extracting cloud service customer data during the decryption process;- Disclosure of user identities and credentials; and- Further measures that have been created or can be used for disclosing cloud service customer data.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-01.01B", + "Description": "The cloud service provider provides cloud service customers with publicly available guidelines and recommendations for the secure use of the cloud service provided. The information contained therein is intended to assist the cloud service customer in the secure configuration, installation and use of the cloud service, as well as the implementation of complementary customer controls, to the extent applicable to the cloud service and the responsibility of the cloud user.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-01 Guidelines and Recommendations for Cloud Service Customers", + "Type": "Basic", + "AboutCriteria": "In a cloud environment, security responsibilities are shared between the cloud service provider and the customer, varying by service type — Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS). Guidance on the complementary customer controls helps cloud service customers understand their roles and responsibilities within the Shared Responsibility Model, also in terms of security and operational management (cf. OIS-03). By offering detailed guidance, cloud service customers are equipped to understand and implement the necessary controls that fall under their responsibility. The level of detail and length can vary according to the type of cloud service provided. Examples for defensive mechanisms include payload filtering, traffic shaping, load balancing, load shedding and DDoS defences. Examples for wide-area distributed architecture mechanisms include replication for fault tolerance, multiple cloud regions to avoid localised outages and disasters and geo-dispersion of service endpoints to reduce user-facing latency.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the cloud service provider's information is used to derive policies, concepts and measures for the secure configuration and use (according to their own risk assessment) of the cloud service. Compliance with these policies, concepts and measures is checked. Changes to the information are promptly assessed for their impact on these documents and any necessary changes are implemented." + } + ], + "Checks": [] + }, + { + "Id": "PSS-01.02B", + "Description": "The type and scope of the information provided will be based on the needs of subject matter experts of the cloud service customers who set information security requirements, implement them or verify the implementation (e.g. IT, Compliance, Internal Audit). The information in the guidelines and recommendations for the secure use of the cloud service address the following aspects, where applicable to the cloud service: - Instructions for secure configuration;- Information sources on known vulnerabilities and update mechanisms;- Malware protection for containers or virtual machines;- Error handling and logging mechanisms;- Authentication mechanisms;- Roles and rights concept including combinations that result in an elevated risk;- Services and functions for administration of the cloud service by privileged users;- Complementary user entity controls;- Encryption mechanisms and services;- Data leakage prevention;- Secure development and operation of applications on the cloud service;- Use and configuration of defensive mechanisms;- Use and configuration of wide-area distributed architecture mechanisms;- Methods used for client data separation (cf. OPS-28 and OPS-29); and- How information security risks related to the use of the cloud service can be addressed through proper logging and monitoring mechanisms.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-01 Product Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-01.03B", + "Description": "The cloud service provider describes in the user documentation all risks the cloud service customer has to manage on its side.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-01 Product Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-01.04B", + "Description": "The information is maintained so that it is applicable to the cloud service provided in the version intended for productive use.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-01 Product Security", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-01.01AC", + "Description": "The cloud service provider promptly notifies cloud service customers about any planned modifications to the cloud service that could result in a loss or downgrade of functionality.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-01 Product Security", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-02.01B", + "Description": "The cloud service provider applies appropriate measures to check the cloud service for vulnerabilities which might have been integrated into the cloud service during the software development process.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-02 Identification of Vulnerabilities of the Cloud Service", + "Type": "Basic", + "AboutCriteria": "Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Malfunctions and Errors - Vulnerability Scans).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-02.02B", + "Description": "The procedures for identifying such vulnerabilities are part of the software development process and, depending on a risk assessment, include the following activities: - Static Application Security Testing;- Dynamic Application Security Testing;- Code reviews by the cloud service provider's subject matter experts;- Conducting security checks based on a Software Bill of Materials (SBOM); and- Obtaining information about confirmed vulnerabilities in software libraries provided by third parties and used in their own cloud service.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-02 Security by Design", + "Type": "Basic", + "AboutCriteria": "Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Malfunctions and Errors - Vulnerability Scans).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-02.03B", + "Description": "The severity of identified vulnerabilities is assessed according to defined criteria and measures are taken to immediately eliminate or mitigate them.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-02 Security by Design", + "Type": "Basic", + "AboutCriteria": "Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Malfunctions and Errors - Vulnerability Scans).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-02.01AC", + "Description": "The procedures for identifying such vulnerabilities also include annual code reviews or security penetration tests by qualified external third parties.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-02 Security by Design", + "Type": "Additional (Complementing)", + "AboutCriteria": "Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Malfunctions and Errors - Vulnerability Scans).", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.01B", + "Description": "The cloud service provider ensures that cloud service customers have access to regularly updated information about known vulnerabilities associated with the cloud service. This includes: - Known-exploited vulnerabilities;- Known vulnerabilities for which a patch and/or mitigating measures are provided by the cloud service provider (N-Day vulnerabilities), with appropriate references to the patch/measure; and- Known vulnerabilities for which a patch and/or mitigating measures are unlikely to be provided by the cloud service provider (Forever-Day vulnerabilities), along with a justification for why they are not provided. These pertain to the provided cloud service and assets provided by the cloud service provider that the cloud service customers have to install, provide or operate within their own responsibility.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Informing Customers about Known Vulnerabilities", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the information in this register is incorporated without undue delay into their own risk management, evaluated and, if necessary, taken into account in their own area of responsibility." + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.02B", + "Description": "The provided information includes a description of the remediation options for that vulnerability.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.03B", + "Description": "These vulnerabilities are also identified based on Software Bill of Materials (SBOM) data.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Basic", + "AboutCriteria": "Although the cloud service provider has to identify the vulnerabilities based on SBOM data to fulfill this criterion, this SBOM data need not be handed over to the customer to fulfill the criterion.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.04B", + "Description": "The vulnerabilities are presented with references to the Common Vulnerabilities and Exposures (CVE) and assessments are based on: - The Common Vulnerability Scoring System (CVSS),- The Exploit Prediction Scoring System (EPSS), and- The Stakeholder-Specific Vulnerability Categorization (SSVC) in the latest version valid at the time of the execution of the control. This information is easily accessible to any cloud service customer and forms a suitable basis for risk assessment and possible follow-up actions on the part of the cloud service customers, among other things through references to vulnerability-specific measures in: - Vulnerability, Exploitability eXchange (VEX), and- Common Security Advisory Frameworks (CSAF).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.05B", + "Description": "The cloud service provider determines when a vulnerability is notified to the cloud service customers as part of Coordinated Vulnerability Disclosure (CVD).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.06B", + "Description": "The cloud service provider consults at least daily the vulnerability registers of its service organisations, analyses the potential impact of the published vulnerabilities on the cloud service, and handles them according to the vulnerability handling process (cf. OPS-18).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.01AC", + "Description": "Assets provided by the cloud service provider, which must be installed, provided or operated by cloud service customers within their area of responsibility, are equipped with automatic update mechanisms. After approval by the respective cloud service customer, software updates are rolled out by the cloud service provider.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "Assets provided by the cloud service provider that cloud service customers have to install, deploy or operate themselves in their area of responsibility are for example local software clients and apps as well as tools for integrating the cloud service. If the cloud service relies on other cloud services, this information should incorporate or refer to the vulnerabilities of those other cloud services in order for this criterion to be met.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-03.02AC", + "Description": "Vulnerabilities are disclosed in accordance with the Common Security Advisory Framework Version 2.0 or higher, and as specified in BSI's Technical Guideline TR-03191.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-03 Security Testing", + "Type": "Additional (Complementing)", + "AboutCriteria": "Assets provided by the cloud service provider that cloud service customers have to install, deploy or operate themselves in their area of responsibility are for example local software clients and apps as well as tools for integrating the cloud service. If the cloud service relies on other cloud services, this information should incorporate or refer to the vulnerabilities of those other cloud services in order for this criterion to be met.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-04.01B", + "Description": "The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the data, services or functions it provides.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-04 Error handling and Logging Mechanisms", + "Type": "Basic", + "AboutCriteria": "Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited to system components under the responsibility of the cloud service customer only.", + "ComplementaryCriteria": "If the cloud service is equipped with error handling and logging mechanisms, cloud service customers must activate these and configure them according to defined requirements. The cloud service customer must incorporate his own information security management for this purpose." + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "PSS-04.02B", + "Description": "These mechanisms are designed to address identified security risks related to the use of the cloud service. The cloud service provider identifies and documents these risks in advance, ensuring that the implemented logging mechanisms capture relevant events and activities.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-04 Security Updates", + "Type": "Basic", + "AboutCriteria": "Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited to system components under the responsibility of the cloud service customer only.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-04.03B", + "Description": "The information is detailed enough to allow cloud users to check the following aspects, insofar as they are applicable to the cloud service: - Which cloud service customer data and cloud service derived data, services or functions available to the cloud user within the cloud service, have been accessed by whom, when and from where (Audit Logs);- Malfunctions during processing of automatic or manual actions; and- Changes to security-relevant configuration parameters, error handling and logging mechanisms, user authentication, action authorisation, cryptography, and communication security.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-04 Security Updates", + "Type": "Basic", + "AboutCriteria": "Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited to system components under the responsibility of the cloud service customer only.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-04.04B", + "Description": "The logged information is protected from unauthorised access and modification and can be deleted by the cloud service customer.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-04 Security Updates", + "Type": "Basic", + "AboutCriteria": "Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited to system components under the responsibility of the cloud service customer only.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-04.05B", + "Description": "If the cloud service customer is responsible for the activation or type and scope of logging, the cloud service provider has provide appropriate logging capabilities.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-04 Security Updates", + "Type": "Basic", + "AboutCriteria": "Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited to system components under the responsibility of the cloud service customer only.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_duration_statement_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudstorage_bucket_log_retention_policy_lock", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled", + "compute_project_os_login_enabled", + "compute_subnet_flow_logs_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", + "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", + "logging_sink_created" + ] + }, + { + "Id": "PSS-04.01AC", + "Description": "Cloud users can retrieve security-related information via documented interfaces which are suitable for further processing this information as part of their Security Information and Event Management (SIEM).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-04 Security Updates", + "Type": "Additional (Complementing)", + "AboutCriteria": "Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited to system components under the responsibility of the cloud service customer only.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-05.01B", + "Description": "The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that allow users, IT components or applications to interact with the cloud service.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-05 Authentication Mechanisms", + "Type": "Basic", + "AboutCriteria": "IT components in the sense of this criterion are independently usable objects with external interfaces that can be connected with other IT components. Access points in the sense of this criterion are those that can be accessed by users, IT components or applications via networks (for users, for example, the login screen on the publicly accessible website of the cloud service provider). Multi-factor authentication can e.g. be performed with cryptographic certificates, smart cards or tokens.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the authentication mechanisms offered by the cloud service are used in accordance with the customer's identity and authorisation management requirements." + } + ], + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "apikeys_api_restrictions_configured", + "apikeys_key_exists", + "apikeys_key_rotated_in_90_days", + "compute_instance_block_project_wide_ssh_keys_disabled", + "dns_rsasha1_in_use_to_key_sign_in_dnssec" + ] + }, + { + "Id": "PSS-05.02B", + "Description": "For privileged users, IT components or applications, these authentication mechanisms are enforced.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-05 Security Monitoring", + "Type": "Basic", + "AboutCriteria": "IT components in the sense of this criterion are independently usable objects with external interfaces that can be connected with other IT components. Access points in the sense of this criterion are those that can be accessed by users, IT components or applications via networks (for users, for example, the login screen on the publicly accessible website of the cloud service provider). Multi-factor authentication can e.g. be performed with cryptographic certificates, smart cards or tokens.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "iam_role_kms_enforce_separation_of_duties" + ] + }, + { + "Id": "PSS-05.01AC", + "Description": "The cloud service offers out-of-band (OOB) authentication, in which the factors are transmitted via different channels (e.g. Internet and mobile network).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-05 Security Monitoring", + "Type": "Additional (Complementing)", + "AboutCriteria": "IT components in the sense of this criterion are independently usable objects with external interfaces that can be connected with other IT components. Access points in the sense of this criterion are those that can be accessed by users, IT components or applications via networks (for users, for example, the login screen on the publicly accessible website of the cloud service provider). Multi-factor authentication can e.g. be performed with cryptographic certificates, smart cards or tokens.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-06.01B", + "Description": "To protect confidentiality, availability, integrity and authenticity during interactions with the cloud service, a suitable session management system is used that corresponds to the state-of-the-art and is protected against known attacks.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-06 Session Management", + "Type": "Basic", + "AboutCriteria": "Known attacks include manipulation, forgery, session takeover, Denial of Service attacks, enveloping, replay and null cipher attacks.", + "ComplementaryCriteria": "Cloud service customers can use appropriate controls to ensure that they are using the session management protection features of the cloud service in accordance with their own ISMS. They also set the time period after which a session becomes invalid according to their own ISMS specifications." + } + ], + "Checks": [] + }, + { + "Id": "PSS-06.02B", + "Description": "Mechanisms are implemented that invalidate a session after it has been detected as inactive. The inactivity can be detected by time measurement. In this case, the time interval can be configured by the cloud service provider or - if technically possible - by the cloud service customer.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-06 Security Incident Response", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-07.01B", + "Description": "If passwords are used as authentication information for the cloud service, their confidentiality is ensured by the following procedures: - Users can initially create the password themselves or must change an initial password when logging in to the cloud service for the first time. An initial password loses its validity after a maximum of 14 days;- When creating passwords, compliance with the length and complexity requirements of the cloud service provider (cf. IAM-09) or the cloud service customer is technically enforced;- The user is informed about changing or resetting the password. Any password reset procedure is not valid for more than 48 hours and the password shall be changed by the user after the use of the reset procedure; and- The server-side storage uses hash functions in combination with salt values, both corresponding to the state-of-the-art. The cloud service provider makes available to the cloud service customers the rules and recommendations that apply to the users under their responsibility, and provides the cloud service customers with tools to manage and enforce these rules.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-07 Confidentiality of Authentication Information", + "Type": "Basic", + "AboutCriteria": "The state-of-the-art regarding cryptographic hash functions is described in the current version of the BSI Technical Guideline TR-02102-1 'Cryptographic Mechanisms: Recommendations and Key Lengths'.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they use sufficiently secure passwords (cf. IAM-09) according to their own assessment and that the risks of unauthorised access associated with their own choice are borne." + } + ], + "Checks": [] + }, + { + "Id": "PSS-07.02B", + "Description": "The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-07 Security Documentation", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-08.01B", + "Description": "The cloud service provider provides cloud users with a roles and rights concept. This concept allows users to manage their own access rights. It describes rights profiles for the functions provided by the cloud service. Cloud users can configure certain access control parameters themselves.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-08 Roles and Rights Concept", + "Type": "Basic", + "AboutCriteria": "In IaaS, a role and rights concept would describe, among other things, the rights profiles for the following functions of the cloud service: - Administration of the states of virtual machines (start, pause, stop) as well as for their migration or monitoring;- Management of available images that can be used to create virtual machines; and- Management of virtual networks (e.g. configuration of virtual routers and switches).", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that: - they actively utilise the roles and rights concept and accompanying functionalities offered by the cloud service provider;- the granting of permissions to users in their area of responsibility is subject to authorisation; and- the appropriateness of the assigned authorisations is regularly reviewed and authorisations are adjusted or withdrawn in a timely manner in the event of necessary changes (e.g. employee resignation)." + } + ], + "Checks": [] + }, + { + "Id": "PSS-08.02B", + "Description": "The rights profiles are suitable for enabling cloud users to manage access authorisations and permissions in accordance with the principle of least-privilege and how it is necessary for the performance of tasks ('need-to-know principle') and to implement the principle of functional separation between operational and controlling functions ('separation of duties').", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-08 Security Training", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-08.03B", + "Description": "The cloud service provider offers a functionality to help cloud service customers review user access rights under their responsibility.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-08 Security Training", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-08.04B", + "Description": "In case the service includes the management of customer identities, for a given customer identity, the cloud service provider is able to provide the list of access rights currently granted to that identity according to the contractual terms.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-08 Security Training", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-09.01B", + "Description": "Access to the functions provided by the cloud service is restricted by access controls (authorisation mechanisms) that verify whether users, IT components, or applications are authorised to perform certain actions.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-09 Authorisation Mechanisms", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures." + } + ], + "Checks": [] + }, + { + "Id": "PSS-09.02B", + "Description": "The cloud service provider validates the functionality of the authorisation mechanisms before new functions are made available to cloud users and in the event of changes to the authorisation mechanisms of existing functions (cf. DEV-06).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-09 Security Compliance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-09.03B", + "Description": "If the validation led to vulnerabilities, the severity of identified vulnerabilities is assessed according to defined criteria based on industry standard metrics (e.g. Common Vulnerability Scoring System) and measures for timely resolution or mitigation are initiated.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-09 Security Compliance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-09.04B", + "Description": "Information about known-exploited vulnerabilities and known vulnerabilities for which a patch and/or mitigating measures are unlikely to be provided by the cloud service provider is included in the information provided to cloud service customers about known vulnerabilities (cf. PSS-03).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-09 Security Compliance", + "Type": "Basic", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-09.01AC", + "Description": "Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-09 Security Compliance", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "compute_instance_default_service_account_in_use_with_full_api_access", + "iam_account_access_approval_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_role_sa_enforce_separation_of_duties" + ] + }, + { + "Id": "PSS-10.01B", + "Description": "If the cloud service offers functions for software-defined networking (SDN), the confidentiality of cloud service customer data is ensured by suitable SDN procedures.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-10 Software Defined Networking", + "Type": "Basic", + "AboutCriteria": "This criterion is typically not applicable to the SaaS service model. Suitable SDN methods for increasing confidentiality are, for example, L2 overlay networking (tagging) or tunnelling/encapsulation.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that they validate the functionality of SDN features for their individual use cases before using newly introduced capabilities or modifed existing ones." + } + ], + "Checks": [] + }, + { + "Id": "PSS-10.02B", + "Description": "The cloud service provider validates the functionality of the SDN functions before providing new SDN features to cloud users or modifying existing SDN features. Identified defects are assessed and corrected in a risk-oriented manner.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-10 Security Governance", + "Type": "Basic", + "AboutCriteria": "This criterion is typically not applicable to the SaaS service model. Suitable SDN methods for increasing confidentiality are, for example, L2 overlay networking (tagging) or tunnelling/encapsulation.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-11.01B", + "Description": "If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so that users of the cloud service customer can only launch the images or containers released according to these restrictions;- Images made available are labelled with information about their origin;- If the cloud service provider provides images of virtual machines or containers to the cloud service customer, the cloud service provider appropriately informs the cloud service customer of the changes made to the previous version; and- In addition, these images provided by the cloud service provider are hardened according to generally accepted industry standards;", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-11 Images for Virtual Machines and Containers", + "Type": "Basic", + "AboutCriteria": "This criterion is typically not applicable to the SaaS service model. Generally accepted industry standards are, for example, the Security Configuration Benchmark of the Centre for Internet Security (CIS) or the corresponding modules in the BSI IT-Grundschutz-Compendium.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that the images of virtual machines or containers they operate with the cloud service comply with their information security management requirements and that the results of the integrity checks at startup and at runtime are processed according to these requirements." + } + ], + "Checks": [ + "artifacts_container_analysis_enabled", + "gcr_container_scanning_enabled" + ] + }, + { + "Id": "PSS-11.01AC", + "Description": "At startup and runtime of virtual machine or container images, an integrity check is performed that detects image manipulations and reports them to the cloud service customer.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-11 Security Risk Management", + "Type": "Additional (Complementing)", + "AboutCriteria": "This criterion is typically not applicable to the SaaS service model. Generally accepted industry standards are, for example, the Security Configuration Benchmark of the Centre for Internet Security (CIS) or the corresponding modules in the BSI IT-Grundschutz-Compendium.", + "ComplementaryCriteria": "" + } + ], + "Checks": [ + "artifacts_container_analysis_enabled", + "gcr_container_scanning_enabled" + ] + }, + { + "Id": "PSS-12.01B", + "Description": "The architecture of the cloud service, including the technical design of its infrastructure, ensures that cloud service customer data and eventual data backups thereof are processed and stored only in the region specified in the contractual agreements with the cloud service provider. If the cloud service customer is able to select from multiple regions, processing and storage of the aforementioned data is limited to the selected region.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Region of Data Processing and Storage", + "Type": "Basic", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "Cloud service customers ensure through suitable controls that, when selecting service providers and configuring the cloud service, they are informed about the available data processing and storage partitions and, if there is a choice between different partitions, that they select those that meet their own requirements. Depending on the use case and especially when using services of a cloud service provider which is based in another country, cloud service customers take the laws of their own jurisdiction applicable to them into account when making their selection (e.g. when processing personal data; compliance with legal retention obligations for business documents, etc.)." + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.01AS", + "Description": "The basic criterion also applies to all cloud service derived data.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Sharpening)", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.02B", + "Description": "Processing and storage of cloud service customer data data within the service organisations of the cloud service provider also adheres to the regions selected by the cloud service customer.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Basic", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.02AS", + "Description": "The basic criterion also applies to all cloud service derived data.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Sharpening)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.03B", + "Description": "The contractual agreements specify the regions in which processing and storage of cloud service customer data, cloud service derived data and account data occurs and the circumstances under which changes may be applied.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Basic", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.03AS", + "Description": "The basic criterion also applies to all cloud service derived data.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Sharpening)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.04B", + "Description": "Customers are notified beforehand in case of any changes to the regions of data processing or storage. If the cloud service provider has not been granted prior general authorisation by the cloud service customer to do so, such authorisations are obtained in accordance with the requirements specified in the contractual agreements or let the cloud service customer exercise termination rights.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Basic", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.04AS", + "Description": "The basic criterion also applies to all cloud service derived data.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Sharpening)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.01AC", + "Description": "The cloud service provider offers partitions selectable by the cloud service customer where partition-specific identity management is enforced for both cloud service customers and all cloud service provider personnel. Identity verification and identity storage are confined to the geographical boundaries of the selected partition.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Complementing)", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.02AC", + "Description": "Within these partitions, the following operations by the cloud service provider are restricted to occur only within the geographical boundaries of the customer-selected partitions: - Privileged access to the production environment by the cloud service provider, including potential access to cloud service customer data and cloud service derived data;- System logging and event monitoring by the cloud service provider, except for processing event logs specifically for threat intelligence and handling IP addresses for routing purposes;- Cryptographic key management and storage practices to ensure keys are handled and stored within limits of the partition. These restrictions considering partitions also apply to any service organisations involved in the operation of the cloud service.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Complementing)", + "AboutCriteria": "This criterion supplements the Boundary Condition BC-01. It does not require the cloud service provider to offer multiple partitions. If the cloud service provider offers only one partition for the cloud service(s) in scope, this does not comprise a deviation from the criterion. If the additional complemental criterion is only applicable for selected partitions in scope of an assurance engagement in accordance with this catalogue, this should be presented in the cloud service provider's description of its system of internal control for the cloud service. This criterion is a prerequisite for technical service sovereignty.", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + }, + { + "Id": "PSS-12.03AC", + "Description": "Monitoring of threat intelligence data, which excludes any cloud service customer data and Account data, and logging of required routing information such as IP addresses are not required to be geographically limited to a single partition.", + "Attributes": [ + { + "Section": "Product Safety and Security (PSS)", + "SubSection": "PSS-12 Security Assessment", + "Type": "Additional (Complementing)", + "AboutCriteria": "", + "ComplementaryCriteria": "" + } + ], + "Checks": [] + } + ] +} diff --git a/prowler/lib/outputs/compliance/c5/c5_gcp.py b/prowler/lib/outputs/compliance/c5/c5_gcp.py new file mode 100644 index 0000000000..85ee9c25e9 --- /dev/null +++ b/prowler/lib/outputs/compliance/c5/c5_gcp.py @@ -0,0 +1,92 @@ +from prowler.config.config import timestamp +from prowler.lib.check.compliance_models import Compliance +from prowler.lib.outputs.compliance.c5.models import GCPC5Model +from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput +from prowler.lib.outputs.finding import Finding + + +class GCPC5(ComplianceOutput): + """ + This class represents the GCP C5 compliance output. + + Attributes: + - _data (list): A list to store transformed data from findings. + - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file. + + Methods: + - transform: Transforms findings into GCP C5 compliance format. + """ + + def transform( + self, + findings: list[Finding], + compliance: Compliance, + compliance_name: str, + ) -> None: + """ + Transforms a list of findings into GCP C5 compliance format. + + Parameters: + - findings (list): A list of findings. + - compliance (Compliance): A compliance model. + - compliance_name (str): The name of the compliance model. + + Returns: + - None + """ + for finding in findings: + # Get the compliance requirements for the finding + finding_requirements = finding.compliance.get(compliance_name, []) + for requirement in compliance.Requirements: + if requirement.Id in finding_requirements: + for attribute in requirement.Attributes: + compliance_row = GCPC5Model( + Provider=finding.provider, + Description=compliance.Description, + ProjectId=finding.account_uid, + Location=finding.region, + AssessmentDate=str(timestamp), + Requirements_Id=requirement.Id, + Requirements_Description=requirement.Description, + Requirements_Attributes_Section=attribute.Section, + Requirements_Attributes_SubSection=attribute.SubSection, + Requirements_Attributes_Type=attribute.Type, + Requirements_Attributes_AboutCriteria=attribute.AboutCriteria, + Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria, + Status=finding.status, + StatusExtended=finding.status_extended, + ResourceId=finding.resource_uid, + ResourceName=finding.resource_name, + CheckId=finding.check_id, + Muted=finding.muted, + Framework=compliance.Framework, + Name=compliance.Name, + ) + self._data.append(compliance_row) + # Add manual requirements to the compliance output + for requirement in compliance.Requirements: + if not requirement.Checks: + for attribute in requirement.Attributes: + compliance_row = GCPC5Model( + Provider=compliance.Provider.lower(), + Description=compliance.Description, + ProjectId="", + Location="", + AssessmentDate=str(timestamp), + Requirements_Id=requirement.Id, + Requirements_Description=requirement.Description, + Requirements_Attributes_Section=attribute.Section, + Requirements_Attributes_SubSection=attribute.SubSection, + Requirements_Attributes_Type=attribute.Type, + Requirements_Attributes_AboutCriteria=attribute.AboutCriteria, + Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria, + Status="MANUAL", + StatusExtended="Manual check", + ResourceId="manual_check", + ResourceName="Manual check", + CheckId="manual", + Muted=False, + Framework=compliance.Framework, + Name=compliance.Name, + ) + self._data.append(compliance_row) diff --git a/prowler/lib/outputs/compliance/c5/models.py b/prowler/lib/outputs/compliance/c5/models.py index 3009708cc6..7d7eda82d6 100644 --- a/prowler/lib/outputs/compliance/c5/models.py +++ b/prowler/lib/outputs/compliance/c5/models.py @@ -55,3 +55,30 @@ class AzureC5Model(BaseModel): Muted: bool Framework: str Name: str + + +class GCPC5Model(BaseModel): + """ + GCPC5Model generates a finding's output in GCP C5 Compliance format. + """ + + Provider: str + Description: str + ProjectId: str + Location: str + AssessmentDate: str + Requirements_Id: str + Requirements_Description: str + Requirements_Attributes_Section: str + Requirements_Attributes_SubSection: str = None + Requirements_Attributes_Type: str = None + Requirements_Attributes_AboutCriteria: Optional[str] = None + Requirements_Attributes_ComplementaryCriteria: Optional[str] = None + Status: str + StatusExtended: str + ResourceId: str + ResourceName: str + CheckId: str + Muted: bool + Framework: str + Name: str