Section 14: Cloud Computing Part 2

Ensure that vendor vendor security policies are at least as stringent as your own

True

Vendor Lock-ins

make it difficult to switch vendors down the road

Vendor Management lifecycle steps

• Vendor Selection

• Onboarding

• Monitoring

• Offboarding

Vendor Selection 

selecting a new vendor which may use a formal RFP or an informal process. It should include security requirements and include assessment of provider’s risk management program

Onboarding

verify contract details, arrange secure data transfer, and establish incident procedures

Monitoring

conduct site visits, review independent audits, handle security incidents

Offboarding

destroys confidential info, unwinds a business relationship, may restart the lifecycle

Agreements

help facilitate vendor relationships

NDAs

protect the confidentiality of information

Service Level Requirements (SLR)

document specific requirements that a customer has about any aspect of a vendor’s service performance 

SLR Examples

• System response time

• service availability

• data preservation 

Other Agreement Types

• Memorandum of understanding (MOU)

• Business Partnership agreement (BPA)

• Interconnection security agreements (ISA)

• Master services agreement (MSA)

• Statement of work (SOW)

You should include security requirements in SLR, SLAs, and other agreements

True

SLAs

Used to define availability requirements for an IT service that an organization is purchasing from a vendor