CIF-1 - Cloud Service Providers
Selection and management of cloud service providers (CSPs): due diligence, certifications, contracts and risk diversification.
Control Definition
Formal criteria must be defined for selecting cloud service providers, verifying their security certifications and the shared responsibility model applicable to each type of service. Due diligence must be performed and contracts must include availability guarantees, the right to audit, incident notification and secure data deletion when the relationship ends. The risk of dependence on a single provider must be assessed periodically and a diversification strategy maintained for the most critical services, governing the entire cycle of contracting, using and exiting cloud services.
Requirements
Requirement 1
We define formal selection criteria for Cloud Service Providers (CSPs).
Requirement 2
We verify the current security certifications of each Cloud Service Provider (CSP).
Requirement 3
We assess the shared responsibility model according to the type of service (IaaS, PaaS, SaaS, among others...).
Requirement 4
We include minimum availability SLAs matching the service's criticality in contracts with Cloud Service Providers (CSPs).
Requirement 5
We maintain a documented multi-cloud or hybrid strategy for highly critical services and review it annually.
Requirement 6
We establish the processes for contracting, using, administering and exiting cloud services in line with the organization's information security requirements.
Requirement 7
We periodically assess the risk of concentration on a single provider (vendor lock-in).
CIF - Infrastructure Cybersecurity
Comprehensive cybersecurity for networks, servers and cloud providers: asset inventory, encryption and architectures with a minimal attack surface.
CIF-2 - Asset Inventory
Automated inventory of cloud resources: owners, tagging, orphaned resource detection and infrastructure as code.