SP-02—Review and Approval of Policies and Instructions
>Control Description
Information security policies and instructions are reviewed at least annually for adequacy by the Cloud Service Provider's subject matter experts.
The review shall consider at least the following aspects:
• Organisational and technical changes in the procedures for providing the cloud service; and
• Legal and regulatory changes in the Cloud Service Provider's environment.
Revised policies and instructions are approved before they become effective.
Additional criteria: -
Ask AI
Configure your API key to use AI features.