SP-01—Documentation, communication and provision of policies and instructions
>Control Description
Policies and instructions (incl. concepts and guidelines) are derived from the information security policy and are documented according to a uniform structure. They are communicated and made available to all internal and external employees of the Cloud Service Provider in an appropriate manner.
The policies and instructions are version controlled and approved by the top management of the Cloud Service Provider or an authorised body.
The policies and instructions describe at least the following aspects:
• Objectives;
• Scope;
• Roles and responsibilities, including staff qualification requirements and the establishment of substitution rules;
• Roles and dependencies on other organisations (especially cloud customers and subservice organisations);
• Steps for the execution of the security strategy; and
• Applicable legal and regulatory requirements.
Additional criteria: -
Ask AI
Configure your API key to use AI features.