OIS-04—Segregation of Duties
>Control Description
Conflicting tasks and responsibilities are separated based on an OIS-06 risk assessment to reduce the risk of unauthorised or unintended changes or misuse of cloud customer data processed, stored or transmitted in the cloud service.
The risk assessment covers the following areas, insofar as these are applicable to the provision of the Cloud Service and are in the area of responsibility of the Cloud Service Provider:
• Administration of rights profiles, approval and assignment of access and access authorisations (cf. IDM-01);
• Development, testing and release of changes (cf. DEV-01); and
• Operation of the system components.
If separation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions.
Additional criteria: -
Ask AI
Configure your API key to use AI features.