Introduction

CAIQv4.0.2

approved, communicated, applied, evaluated, and maintained?

A&A-01 Establish, document, approve, communicate, apply, evaluate and maintain audit and assurance policies and procedures and standards. Review and update the policies and procedures at least annually.

at least annually?

A&A-02.1 Are independent audit and assurance assessments conducted according to relevant standards at least annually?

A&A-02 Conduct independent audit and assurance assessments according to relevant standards at least annually.

plans and policies?

A&A-03 Perform independent audit and assurance assessments according to risk-based plans and policies.

and statutory requirements applicable to the audit?

A&A-04 Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.

risk analysis, security control assessments, conclusions, remediation schedules, report generation, and reviews of past reports and supporting evidence?

A&A-05 Define and implement an Audit Management process to support audit planning, risk analysis, security control assessment, conclusion, remediation schedules, report generation, and review of past reports and supporting evidence.

documented, approved, communicated, applied, evaluated, and maintained?

A&A-06 Establish, document, approve, communicate, apply, evaluate and maintain a risk-based corrective action plan to remediate audit findings, review and report remediation status to relevant stakeholders.

stakeholders?

AIS-01.1 Are application security policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained to guide appropriate planning, delivery, and support of the organization's application security capabilities?

AIS-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for application security to provide guidance to the appropriate planning, delivery and support of the organization's application security capabilities. Review and update the policies and procedures at least annually.

annually?

AIS-02.1 Are baseline requirements to secure different applications established, documented, and maintained?

AIS-02 Establish, document and maintain baseline requirements for securing different applications.

business objectives, security requirements, and compliance obligations?

AIS-03 Define and implement technical and operational metrics in alignment with business objectives, security requirements, and compliance obligations.

deployment, and operation per organizationally designed security requirements?

AIS-04 Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.

upgrades, and new versions while ensuring application security, compliance adherence, and organizational speed of delivery goals?

AIS-05 Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.

AIS-06.1 Are strategies and capabilities established and implemented to deploy application code in a secure, standardized, and compliant manner?

AIS-06 Establish and implement strategies and capabilities for secure, standardized, and compliant application deployment. Automate where possible.

vulnerabilities, automating remediation when possible.

possible?

BCR-01.1 Are business continuity management and operational resilience policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?

BCR-01 Establish, document, approve, communicate, apply, evaluate and maintain business continuity management and operational resilience policies and procedures.

Review and update the policies and procedures at least annually.

BCR-02.1 Are criteria for developing business continuity and operational resiliency strategies and capabilities established based on business disruption and risk impacts?

BCR-02 Determine the impact of business disruptions and risks to establish criteria for developing business continuity and operational resilience strategies and capabilities.

business disruptions in accordance with risk appetite?

BCR-03 Establish strategies to reduce the impact of, withstand, and recover from business disruptions within risk appetite.

to establish, document, approve, communicate, apply, evaluate, and maintain a business continuity plan?

BCR-04 Establish, document, approve, communicate, apply, evaluate and maintain a business continuity plan based on the results of the operational resilience strategies and capabilities.

continuity and operational resilience plans?

BCR-05 Develop, identify, and acquire documentation that is relevant to support the business continuity and operational resilience programs. Make the documentation available to authorized stakeholders and review periodically.

to authorized stakeholders?

BCR-05.3 Is business continuity and operational resilience documentation reviewed periodically?

BCR-06.1 Are the business continuity and operational resilience plans exercised and tested at least annually and when significant changes occur?

BCR-06 Exercise and test business continuity and operational resilience plans at least annually or upon significant changes.

stakeholders and participants?

BCR-07 Establish communication with stakeholders and participants in the course of business continuity and resilience procedures.

integrity and availability of the backup, and verify data restoration from backup for resiliency.

BCR-08.3 Can backups be restored appropriately for resiliency?

BCR-09.1 Is a disaster response plan established, documented, approved, applied, evaluated, and maintained to ensure recovery from natural and man-made disasters?

BCR-09 Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.

changes occur?

BCR-10.1 Is the disaster response plan exercised annually or when significant changes occur?

BCR-10 Exercise the disaster response plan annually or upon significant changes, including if possible local emergency authorities.

BCR-11.1 Is business-critical equipment supplemented with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards?

BCR-11 Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.

assets including applications, systems, infrastructure, configuration, etc., established, documented, approved, communicated, applied, evaluated and maintained (regardless of whether asset management is internal or external)?

CCC-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for managing the risks associated with applying changes to organization assets, including application, systems, infrastructure, configuration, etc., regardless of whether the assets are managed internally or externally (i.e., outsourced). Review and update the policies and procedures at least annually.

CCC-02.1 Is a defined quality change control, approval and testing process (with established baselines, testing, and release standards) followed?

CCC-02 Follow a defined quality change control, approval and testing process with established baselines, testing, and release standards.

systems, infrastructure, configuration, etc.) managed, regardless of whether asset management occurs internally or externally (i.e., outsourced)?

CCC-03 Manage the risks associated with applying changes to organization assets, including application, systems, infrastructure, configuration, etc., regardless of whether the assets are managed internally or externally (i.e., outsourced).

assets restricted?

CCC-04 Restrict the unauthorized addition, removal, update, and management of organization assets.

and require tenants to authorize requests explicitly included within the service level agreements (SLAs) between CSPs and CSCs?

CCC-05 Include provisions limiting changes directly impacting CSCs owned environments/tenants to explicitly authorized requests within service level agreements between CSPs and CSCs.

on organizational assets?

CCC-06 Establish change management baselines for all relevant authorized changes on organization assets.

deviate from established baselines?

CCC-07 Implement detection measures with proactive notification in case of changes deviating from the established baseline.

the change and configuration process?

CCC-08 'Implement a procedure for the management of exceptions, including emergencies, in the change and configuration process. Align the procedure with the requirements of GRC-04: Policy Exception Process.'

Process?'

CCC-09.1 Is a process to proactively roll back changes to a previously known "good state" defined and implemented in case of errors or security concerns?

CCC-09 Define and implement a process to proactively roll back changes to a previous known good state in case of errors or security concerns.

documented, approved, communicated, applied, evaluated, and maintained?

CEK-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for Cryptography, Encryption and Key Management. Review and update the policies and procedures at least annually.

and updated at least annually?

CEK-02.1 Are cryptography, encryption, and key management roles and responsibilities defined and implemented?

CEK-02 Define and implement cryptographic, encryption and key management roles and responsibilities.

libraries certified to approved standards?

CEK-03 Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.

classification, associated risks, and encryption technology usability?

CEK-04 Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.

implement and communicate cryptography, encryption, and key management technology changes that accommodate internal and external sources?

CEK-05 Establish a standard change management procedure, to accommodate changes from internal and external sources, for review, approval, implementation and communication of cryptographic, encryption and key management technology changes.

policies, and procedures, managed and adopted in a manner that fully accounts for downstream effects of proposed changes, including residual risk, cost, and benefits analysis?

CEK-06 Manage and adopt changes to cryptography-, encryption-, and key management-related systems (including policies and procedures) that fully account for downstream effects of proposed changes, including residual risk, cost, and benefits analysis.

and maintained that includes risk assessment, risk treatment, risk context, monitoring, and feedback provisions?

CEK-07 Establish and maintain an encryption and key management risk program that includes provisions for risk assessment, risk treatment, risk context, monitoring, and feedback.

keys?

CEK-08 CSPs must provide the capability for CSCs to manage their own data encryption keys.

with a frequency proportional to the system's risk exposure, and after any security event?

CEK-09 Audit encryption and key management systems, policies, and processes with a frequency that is proportional to the risk exposure of the system with audit occurring preferably continuously but at least annually and after any security event(s).

(preferably continuously but at least annually)?

CEK-10.1 Are cryptographic keys generated using industry-accepted and approved cryptographic libraries that specify algorithm strength and random number generator specifications?

CEK-10 Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.

secret?

CEK-11 Manage cryptographic secret and private keys that are provisioned for a unique purpose.

information disclosure risks and legal and regulatory requirements?

CEK-12 Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.

cryptoperiod (when a key is compromised, or an entity is no longer part of the organization) per defined, implemented, and evaluated processes, procedures, and technical measures to include legal and regulatory requirement provisions?

CEK-13 Define, implement and evaluate processes, procedures and technical measures to revoke and remove cryptographic keys prior to the end of its established cryptoperiod, when a key is compromised, or an entity is no longer part of the organization, which include provisions for legal and regulatory requirements.

defined, implemented and evaluated to address key destruction outside secure environments, revocation of keys stored in hardware security modules (HSMs), and include applicable legal and regulatory requirement provisions?

CEK-14 Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.

state (i.e., when they have been generated but not authorized for use) being defined, implemented, and evaluated to include legal and regulatory requirement provisions?

CEK-15 Define, implement and evaluate processes, procedures and technical measures to create keys in a pre-activated state when they have been generated but not authorized for use, which include provisions for legal and regulatory requirements.

key transitions (e.g., from any state to/from suspension) being defined, implemented, and evaluated to include legal and regulatory requirement provisions?

CEK-16 Define, implement and evaluate processes, procedures and technical measures to monitor, review and approve key transitions from any state to/from suspension, which include provisions for legal and regulatory requirements.

time of their expiration date) being defined, implemented, and evaluated to include legal and regulatory requirement provisions?

CEK-17 Define, implement and evaluate processes, procedures and technical measures to deactivate keys at the time of their expiration date, which include provisions for legal and regulatory requirements.

in a secure repository (requiring least privilege access) being defined, implemented, and evaluated to include legal and regulatory requirement provisions?

CEK-18 Define, implement and evaluate processes, procedures and technical measures to manage archived keys in a secure repository requiring least privilege access, which include provisions for legal and regulatory requirements.

specific scenarios (e.g., only in controlled circumstances and thereafter only for data decryption and never for encryption) being defined, implemented, and evaluated to include legal and regulatory requirement provisions?

CEK-19 Define, implement and evaluate processes, procedures and technical measures to use compromised keys to encrypt information only in controlled circumstance, and thereafter exclusively for decrypting data and never for encrypting data, which include provisions for legal and regulatory requirements.

risks (versus the risk of losing control of keying material and exposing protected data) being defined, implemented, and evaluated to include legal and regulatory requirement provisions?

CEK-20 Define, implement and evaluate processes, procedures and technical measures to assess the risk to operational continuity versus the risk of the keying material and the information it protects being exposed if control of the keying material is lost, which include provisions for legal and regulatory requirements.

defined, implemented, and evaluated to track and report all cryptographic materials and status changes that include legal and regulatory requirements provisions?

CEK-21 Define, implement and evaluate processes, procedures and technical measures in order for the key management system to track and report all cryptographic materials and changes in status, which include provisions for legal and regulatory requirements.

the organization's premises established, documented, approved, communicated, enforced, and maintained?

DCS-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the secure disposal of equipment used outside the organization's premises. If the equipment is not physically destroyed a data destruction procedure that renders recovery of information impossible must be applied. Review and update the policies and procedures at least annually.

information impossible if equipment is not physically destroyed?

DCS-01.3 Are policies and procedures for the secure disposal of equipment used outside the organization's premises reviewed and updated at least annually?

DCS-02.1 Are policies and procedures for the relocation or transfer of hardware, software, or data/information to an offsite or alternate location established, documented, approved, communicated, implemented, enforced, maintained?

DCS-02 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the relocation or transfer of hardware, software, or data/information to an offsite or alternate location. The relocation or transfer request requires the written or cryptographically verifiable authorization.

Review and update the policies and procedures at least annually.

verifiable authorization?

DCS-02.3 Are policies and procedures for the relocation or transfer of hardware, software, or data/information to an offsite or alternate location reviewed and updated at least annually?

DCS-03.1 Are policies and procedures for maintaining a safe and secure working environment (in offices, rooms, and facilities) established, documented, approved, communicated, enforced, and maintained?

DCS-03 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for maintaining a safe and secure working environment in offices, rooms, and facilities. Review and update the policies and procedures at least annually.

(e.g., offices, rooms) reviewed and updated at least annually?

DCS-04.1 Are policies and procedures for the secure transportation of physical media established, documented, approved, communicated, enforced, evaluated, and maintained?

DCS-04 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the secure transportation of physical media. Review and update the policies and procedures at least annually.

reviewed and updated at least annually?

DCS-05.1 Is the classification and documentation of physical and logical assets based on the organizational business risk?

DCS-05 Classify and document the physical, and logical assets (e.g., applications) based on the organizational business risk.

tracked within a secured system?

DCS-06 Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.

and information systems?

DCS-07 Implement physical security perimeters to safeguard personnel, data, and information systems. Establish physical security perimeters between the administrative and business areas and the data storage and processing facilities areas.

areas, data storage, and processing facilities?

and egress areas restricted, documented, and monitored by physical access control mechanisms?

DCS-09 Allow only authorized personnel access to secure areas, with all ingress and egress points restricted, documented, and monitored by physical access control mechanisms. Retain access control records on a periodic basis as deemed appropriate by the organization.

the organization?

DCS-10.1 Are external perimeter datacenter surveillance systems and surveillance systems at all ingress and egress points implemented, maintained, and operated?

DCS-10 Implement, maintain, and operate datacenter surveillance systems at the external perimeter and at all the ingress and egress points to detect unauthorized ingress and egress attempts.

attempts?

DCS-11 Train datacenter personnel to respond to unauthorized ingress or egress attempts.

evaluated to ensure risk-based protection of power and telecommunication cables from interception, interference, or damage threats at all facilities, offices, and rooms?

DCS-12 Define, implement and evaluate processes, procedures and technical measures that ensure a risk-based protection of power and telecommunication cables from a threat of interception, interference or damage at all facilities, offices and rooms.

and test that on-site temperature and humidity conditions fall within accepted industry standards effectively implemented and maintained?

DCS-13 Implement and maintain data center environmental control systems that monitor, maintain and test for continual effectiveness the temperature and humidity conditions within accepted industry standards.

intervals for continual effectiveness?

DCS-14 Secure, monitor, maintain, and test utilities services for continual effectiveness at planned intervals.

probability of environmental risk events?

DCS-15 Keep business-critical equipment away from locations subject to high probability for environmental risk events.

enforced, evaluated, and maintained for the classification, protection, and handling of data throughout its lifecycle according to all applicable laws and regulations, standards, and risk level?

DSP-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the classification, protection and handling of data throughout its lifecycle, and according to all applicable laws and regulations, standards, and risk level. Review and update the policies and procedures at least annually.

at least annually?

DSP-02.1 Are industry-accepted methods applied for secure data disposal from storage media so information is not recoverable by any forensic means?

DSP-02 Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.

(at a minimum)?

DSP-03 Create and maintain a data inventory, at least for any sensitive data and personal data.

where it is stored and transmitted?

DSP-05 Create data flow documentation to identify what data is processed, stored or transmitted where. Review data flow documentation at defined intervals, at least annually, and after any change.

and after any change?

DSP-06.1 Is the ownership and stewardship of all relevant personal and sensitive data documented?

DSP-06 Document ownership and stewardship of all relevant documented personal and sensitive data. Perform review at least annually.

DSP-07.1 Are systems, products, and business practices based on security principles by design and per industry best practices?

DSP-07 Develop systems, products, and business practices based upon a principle of security by design and industry best practices.

by design and according to industry best practices?

DSP-08 Develop systems, products, and business practices based upon a principle of privacy by design and industry best practices. Ensure that systems' privacy settings are configured by default, according to all applicable laws and regulations.

laws and regulations?

DSP-09.1 Is a data protection impact assessment (DPIA) conducted when processing personal data and evaluating the origin, nature, particularity, and severity of risks according to any applicable laws, regulations and industry best practices?

DSP-09 Conduct a Data Protection Impact Assessment (DPIA) to evaluate the origin, nature, particularity and severity of the risks upon the processing of personal data, according to any applicable laws, regulations and industry best practices.

evaluated to ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope (as permitted by respective laws and regulations)?

DSP-10 Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.

evaluated to enable data subjects to request access to, modify, or delete personal data (per applicable laws and regulations)?

DSP-11 Define and implement, processes, procedures and technical measures to enable data subjects to request access to, modification, or deletion of their personal data, according to any applicable laws and regulations.

evaluated to ensure personal data is processed (per applicable laws and regulations and for the purposes declared to the data subject)?

DSP-12 Define, implement and evaluate processes, procedures and technical measures to ensure that personal data is processed according to any applicable laws and regulations and for the purposes declared to the data subject.

evaluated for the transfer and sub-processing of personal data within the service supply chain (according to any applicable laws and regulations)?

DSP-13 Define, implement and evaluate processes, procedures and technical measures for the transfer and sub-processing of personal data within the service supply chain, according to any applicable laws and regulations.

evaluated to disclose details to the data owner of any personal or sensitive data access by sub-processors before processing initiation?

DSP-14 Define, implement and evaluate processes, procedures and technical measures to disclose the details of any personal or sensitive data access by sub-processors to the data owner prior to initiation of that processing.

before replicating or using production data in non-production environments?

DSP-15 Obtain authorization from data owners, and manage associated risk before replicating or using production data in non-production environments.

applicable laws, and regulations?

DSP-16 Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.

to protect sensitive data throughout its lifecycle?

DSP-17 Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.

and respond to requests for disclosure of Personal Data by Law Enforcement Authorities according to applicable laws and regulations?

DSP-18 The CSP must have in place, and describe to CSCs the procedure to manage and respond to requests for disclosure of Personal Data by Law Enforcement Authorities according to applicable laws and regulations. The CSP must give special attention to the notification procedure to interested CSCs, unless otherwise prohibited, such as a prohibition under criminal law to preserve confidentiality of a law enforcement investigation.

CSCs, unless otherwise prohibited, such as a prohibition under criminal law to preserve confidentiality of a law enforcement investigation?

DSP-19.1 Are processes, procedures, and technical measures defined and implemented to specify and document physical data locations, including locales where data is processed or backed up?

DSP-19 Define and implement, processes, procedures and technical measures to specify and document the physical locations of data, including any locations in which data is processed or backed up.

leadership established, documented, approved, communicated, applied, evaluated, and maintained?

GRC-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for an information governance program, which is sponsored by the leadership of the organization. Review and update the policies and procedures at least annually.

GRC-02.1 Is there an established formal, documented, and leadership-sponsored enterprise risk management (ERM) program that includes policies and procedures for identification, evaluation, ownership, treatment, and acceptance of cloud security and privacy risks?

GRC-02 Establish a formal, documented, and leadership-sponsored Enterprise Risk Management (ERM) program that includes policies and procedures for identification, evaluation, ownership, treatment, and acceptance of cloud security and privacy risks.

at least annually, or when a substantial organizational change occurs?

GRC-03 Review all relevant organizational policies and associated procedures at least annually or when a substantial change occurs within the organization.

and followed whenever a deviation from an established policy occurs?

GRC-04 Establish and follow an approved exception process as mandated by the governance program whenever a deviation from an established policy occurs.

domains) been developed and implemented?

GRC-05 Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.

and improving governance programs defined and documented?

GRC-06 Define and document roles and responsibilities for planning, implementing, operating, assessing, and improving governance programs.

requirements applicable to your organization identified and documented?

GRC-07 Identify and document all relevant standards, regulations, legal/contractual, and statutory requirements, which are applicable to your organization.

groups and other relevant entities?

GRC-08 Establish and maintain contact with cloud-related special interest groups and other relevant entities in line with business context.

but not limited to remote employees, contractors, and third parties) established, documented, approved, communicated, applied, evaluated, and maintained?

HRS-01 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for background verification of all new employees (including but not limited to remote employees, contractors, and third parties) according to local laws, regulations, ethics, and contractual constraints and proportional to the data classification to be accessed, the business requirements, and acceptable risk. Review and update the policies and procedures at least annually.

local laws, regulations, ethics, and contractual constraints and proportional to the data classification to be accessed, business requirements, and acceptable risk?

HRS-01.3 Are background verification policies and procedures reviewed and updated at least annually?

HRS-02.1 Are policies and procedures for defining allowances and conditions for the acceptable use of organizationally-owned or managed assets established, documented, approved, communicated, applied, evaluated, and maintained?

HRS-02 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for defining allowances and conditions for the acceptable use of organizationally-owned or managed assets. Review and update the policies and procedures at least annually.

the acceptable use of organizationally-owned or managed assets reviewed and updated at least annually?

HRS-03.1 Are policies and procedures requiring unattended workspaces to conceal confidential data established, documented, approved, communicated, applied, evaluated, and maintained?

HRS-03 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures that require unattended workspaces to not have openly visible confidential data. Review and update the policies and procedures at least annually.

data reviewed and updated at least annually?

HRS-04.1 Are policies and procedures to protect information accessed, processed, or stored at remote sites and locations established, documented, approved, communicated, applied, evaluated, and maintained?

HRS-04 Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect information accessed, processed or stored at remote sites and locations. Review and update the policies and procedures at least annually.

stored at remote sites and locations reviewed and updated at least annually?

HRS-05.1 Are return procedures of organizationally-owned assets by terminated employees established and documented?

HRS-05 Establish and document procedures for the…