OPS-19—Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests
>Control Description
The Cloud Service Provider has penetration tests carried out by qualified internal personnel or external service providers at least once a year. The penetration tests are carried out according to a documented test methodology and include the system components relevant to the provision of the cloud service in the area of responsibility of the Cloud Service Provider, which have been identified as such in a risk analysis.
The Cloud Service Provider assess the severity of the findings made in penetration tests according to defined criteria.
For findings with medium or high criticality regarding the confidentiality, integrity or availability of the cloud service, actions must be taken within defined time windows for prompt remediation or mitigation.
Additional criteria: The tests are carried out every six months. They must always be performed by independent external auditors. Internal personnel for penetration tests may support the external service providers.
Ask AI
Configure your API key to use AI features.