SSO-04—Monitoring of compliance with requirements
>Control Description
The Cloud Service Provider monitors compliance with information security requirements and applicable legal and regulatory requirements in accordance with policies and instructions concerning controlling and monitoring of third-parties.
Monitoring includes a regular review of the following evidence to the extent that such evidence is to be provided by third parties in accordance with the contractual agreements:
• reports on the quality of the service provided;
• certificates of the management systems' compliance with international standards;
• independent third-party reports on the suitability and operating effectiveness of their service-related internal control systems; and
• Records of the third parties on the handling of vulnerabilities, security incidents and malfunctions.
The frequency of the monitoring corresponds to the classification of the third party based on the risk assessment conducted by the Cloud Service Provider (cf. SSO-02). The results of the monitoring are included in the review of the third party's risk assessment.
Identified violations and deviations are subjected to analysis, evaluation and treatment in accordance with the risk management procedure (cf. OIS-07).
Additional criteria: The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects:
• Configuration of system components;
• Performance and availability of system components;
• Response time to malfunctions and security incidents; and
• Recovery time (time until completion of error handling).
Identified violations and discrepancies are automatically reported to the responsible personnel or system components of the Cloud Service Provider for prompt assessment and action.
Ask AI
Configure your API key to use AI features.