OIS-07—Application of the Risk Management Policy
>Control Description
The Cloud Service Provider executes the process for handling risks as needed or at least once a year. The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the Cloud Service Provider:
• Processing, storage or transmission of data of cloud customers with different protection needs;
• Occurrence of vulnerabilities and malfunctions in technical protective measures for separating shared resources;
• Attacks via access points, including interfaces accessible from public networks;
• Conflicting tasks and areas of responsibility that cannot be separated for organisational or technical reasons; and
• Dependencies on subservice organisations.
The analysis, evaluation and treatment of risks, including the approval of actions and acceptance of residual risks, is reviewed for adequacy at least annually by the risk owners.
Additional criteria: -
Ask AI
Configure your API key to use AI features.