EM-11—Service Agreement

>Control Description

When customers sign-up for Organization's product and services, the customer is required to acknowledge a service agreement which includes considerations for protecting security, availability, confidentiality and indicates the responsibilities of the users and organization's responsibilities and commitments.

Theme

Process

Type

Preventive

Policy/Standard

Third-Party Service Agreement

>Implementation Guidance

1. Ensure that the customers acknowledge a service agreement including considerations for protecting security, availability, confidentiality. 2. Ensure that the service agreement contains responsibilities of users and the organization.

>Testing Procedure

1. Validate whether customers acknowledge a service agreement. 2. Validate whether the agreement contains considerations for protecting security, availability, confidentiality. 3. Validate whether the agreement contains users and organizations responsibilities.