Please enable JavaScript.

Coggle requires JavaScript to display documents.

3.4.5 (INFORMATION SECURITY AND EXTERNAL PARTIES (Addressing Security…

- - - - risk is involved should be identified and controls implemented
        
        issues to be considered
        
        The information processing facilities an external party is required to access
        
        type of access the external party will have
        
        – Physical access (e.g., to offices, computer rooms and filing cabinets)
        
        – Logical access (e.g., to an organization’s databases and information systems)
        
        – Network connectivity between the organization’s and the external party’s network(s) (e.g., permanent connection and remote access)
        
        – Whether the access is taking place onsite or offsite
        
        value and sensitivity of the information involved and its criticality for business operations :diamond_shape_with_a_dot_inside:
        
        controls necessary to protect information not intended to be accessible by external parties
        
        external party personnel involved in handling the organization’s information
        
        organization or personnel authorized to have access can be identified,
        
        impact of access not being available to the external party when required and the external party entering or receiving inaccurate or misleading information
        
        different means and controls employed by the external party when storing, processing, communicating, sharing, exchanging and destroying information
        
        Practices and procedures to deal with information security incidents and potential damages and the terms and conditions for the continuation of external party access in the case of an information security incident
        
        Legal and regulatory requirements and other contractual obligations relevant to the external party that should be taken into account :female-judge::skin-tone-2:
        
        interests of any other stakeholders may be affected by the arrangements
      - risk assessment should be carried out to identify any requirements for specific controls.
      - all security requirements resulting from work with external parties or internal controls should be reflected by the agreement with the external party.
        
        should be ensured that the external party is aware of its obligations and accepts the responsibilities and liabilities
      - if a high degree of outsourcing is applied or where there are several external parties involved
        
        Organizations may face risk associated with interorganizational processes, management and communication,
  - - - • Description of the product or service to be provided :writing_hand:
      - • The different reasons, requirements and benefits for customer access :+1::skin-tone-5:
      - • Arrangements for reporting, notification and investigation :bellhop_bell:
        
        of information inaccuracies (e.g., of personal details),
        
        information security incidents
        
        and security breaches
      - • The target level of service and unacceptable levels of service :level_slider:
      - • The right to monitor and revoke any activity related to the organization’s assets :forbidden: :eyes:
      - • The respective liabilities of the organization and the customer :money_with_wings:
      - • Responsibilities with respect to legal matters and ensuring that the legal requirements are met (e.g., data protection ), considering different national legal systems if the agreement involves cooperation with customers in other countries :male-judge:
      - • Intellectual property rights (IPRs), copyright assignment and protection of any collaborative work :closed_book:
- - - - If information security management is outsourced :fist-2:
        
        the agreements should address how the third party will guarantee that adequate security
        
        maintained and how security will be adapted
        to identify and deal with changes to risk
  - - - such as digital rights management (DRM) where access control technologies are used bypublishers,
      - copyright holders and individuals to impose limitations on the usage of digital content and devices
        
        printing of the document, copying, authorized readers or using it after a certain date.
- - - - employees, contractors and third-party users understand their responsibilities and are suitable for their assigned roles
    - - • Security responsibilities should be addressed prior to employment in
        
        adequate job descriptions
        
        and in terms and conditions of employment.
      - • All candidates for employment, contractors and third-party users should be adequately screened, especially for sensitive jobs.
      - • Employees, contractors and third-party users of information processing facilities should sign an agreement on their security roles and responsibilities, including the need to maintain confidentiality.
  - - - carried out and documented in accordance with
        
        relevant laws, regulations and ethics
        
        proportional to the business requirements
        
        classification of the information to be accessed and the perceived risk.
    - - responsibility of screening and
      - notification procedures they need to follow if screening has not been completed or if the results give cause for doubt or concern.
  - - - access rights removed upon termination of their employment, contract or agreement, or adjusted upon change.
      - or adapted include physical and logical access, keys, identification cards, information processing facilities, subscriptions, and
        
        removal from any documentation that identifies them as a current member of the organization.
      - departing employee, contractor or third-party user has known passwords for accounts remaining active, these should be changed
      - depending on the evaluation of risk factors, such as:
        
        • Whether the termination or change is initiated by the employee, contractor or third-party user, or by management and the reason of termination
        
        • The current responsibilities of the employee, contractor or any other user
        
        • The value of the assets currently accessible
        
        Procedures should be in place to ensure that information security management is promptly informed of all employee movements, including employees leaving the organization.