Compliance, Mapped to Your Cloud

Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

The organisation should establish and maintain contact with relevant authorities.

An appropriate set of procedures for information labelling should be developed and implemented in accordance with the information classification scheme adopted by the organisation.

Rules to control physical and logical access to information and other associated assets should be established

The full lifecycle of identities should be managed.

Allocation and management of authentication information should be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

Access rights to information and other associated assets should be provisioned, reviewed, modified and removed in accordance with the organisation’s topic-specific policy on and rules for access control.

Processes and procedures should be defined and implemented to manage the information security risks associated with the use of supplier’s products or services.

Processes and procedures should be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.

The organisation should regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

The organisation should assess information security events and decide if they are to be categorised as information security incidents.

Information security incidents should be responded to in accordance with the documented procedures.

The organisation should establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.

The organisation should plan how to maintain information security at an appropriate level during disruption.

Information stored on, processed by or accessible via user endpoint devices should be protected.

The allocation and use of privileged access rights should be restricted and managed.

Access to information and other associated assets should be restricted in accordance with the established topic-specific policy on access control.

Read and write access to source code, development tools and software libraries should be appropriately managed.

Secure authentication technologies and procedures should be implemented based on information access restrictions and the topic-specific policy on access control.

Protection against malware should be implemented and supported by appropriate user awareness.

Configurations, including security configurations, of hardware, software, services and networks should be established, documented, implemented, monitored and reviewed.

Information stored in information systems, devices or in any other storage media should be deleted when no longer required.

Data masking should be used in accordance with the organisation’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.

Data leakage prevention measures should be applied to systems, networks and any other devices that process, store or transmit sensitive information.

Backup copies of information, software and systems should be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.

Information processing facilities should be implemented with redundancy sufficient to meet availability

Logs that record activities, exceptions, faults and other relevant events should be produced, stored, protected and analysed.

Networks, systems and applications should be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

Networks and network devices should be secured, managed and controlled to protect information in systems and applications.

Security mechanisms, service levels and service requirements of network services should be identified, implemented and monitored.

Security mechanisms, service levels and service requirements of network services should be identified, implemented and monitored.

Access to external websites should be managed to reduce exposure to malicious content.

Rules for the effective use of cryptography, including cryptographic key management, should be defined and implemented.

Principles for engineering secure systems should be established, documented, maintained and applied to any information system development activities.