Data Governance Can you provide (describe/explain/attach/embed associated documents) a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource? Data Governance Nonproduction Data Do you have (describe/explain/attach/embed associated documents) procedures in place to ensure production data shall not be replicated or used in environments? Data Governance Information Leakage Do you have (describe/explain/attach/embed associated documents) controls in place to prevent data leakage or intentional/accidental compromise between tenants in a multi-tenant environment? Data Governance Do you have (describe/explain/attach/embed associated documents) a Data Loss Prevention (DLP) or extrusion prevention solution in place for all systems which interface with your cloud service offering?
Information Security Is any change in status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization? Information Security User Access Reviews Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)? Information Security If users are found to have inappropriate entitlements, are all remediation and certification actions recorded? Information Security Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data? Information Security Training / Awareness Do you provide (describe/explain/attach/embed associated documents) or make available a formal security awareness training program for cloud-related access and data management issues (i.e., multi-tenancy, nationality, cloud delivery model segregation of duties implications, and conflicts of interest) for all persons with access to tenant data? Information Security Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity? Information Security Industry Knowledge / Benchmarking Do you participate in industry groups and professional associations related to information security?
Information Security Do you ensure that security threat detection systems that use signatures, lists, or behavioral patterns are updated across all infrastructure components within industry accepted timeframes? Information Security Incident Management Do you have (describe/explain/attach/embed associated documents) a documented security incident response plan? Information Security Do you integrate customized tenant requirements into your security incident response plans? Information Security Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents? Information Security Incident Reporting Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? Information Security Does your logging and monitoring framework allow isolation of an incident to specific tenants? Information Security Incident Response Legal Preparation Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes & controls? Information Security Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? Information Security Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific
Information Security Utility Programs Access Are utilities that can significantly manage virtualized partitions (ex. shutdown, clone, etc.) appropriately restricted and monitored? Information Security Do you have (describe/explain/attach/embed associated documents) a capability to detect attacks which target the virtual infrastructure directly (ex. shimming, Blue Pill, Hyper jumping, etc.)? Information Security Are attacks that target the virtual infrastructure prevented with technical controls? Legal Legal Nondisclosure Agreements Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented and reviewed at planned intervals? Legal Third Party Agreements Do you select and monitor outsourced providers to verify that they comply with laws in the country where the data is processed and stored and transmitted? Legal Do you select and monitor outsourced providers in compliance with laws in the country where the data originates? Legal Does legal counsel review all third party agreements?
Release Management Quality Testing Do you provide (describe/explain/attach/embed associated documents) your tenants with documentation which describes your quality assurance process? Release Management Outsourced Development Do you have (describe/explain/attach/embed associated documents) controls in place to ensure that standards of quality are being met for all software development? Release Management Do you have (describe/explain/attach/embed associated documents) controls in place to detect source code security defects for any outsourced software development activities? Release Management Unauthorized Software Installations Do you have (describe/explain/attach/embed associated documents) controls in place to restrict and monitor the installation of unauthorized software onto your systems? Resiliency Resiliency Management Program Are Policy, process and procedures defining business continuity and disaster recovery in place to minimize the impact of a realized risk event and properly communicated to tenants? Resiliency Impact Analysis Do you provide (describe/explain/attach/embed associated documents) tenants with ongoing visibility and reporting into your operational Service Level Agreement (SLA) performance?