Documentation of customer groups whose information is processed by the organization

Critical
High
Normal
Low

Organisation must define

  • stakeholders relevant to the information security management system
  • information security requirements set by these stakeholders

Customer groups or individual significant customers that are important to the organization's operations are usually one of the most important stakeholders, also from the point of view of information security. Other stakeholders are treated through other tasks.

Connected other frameworks and requirements:
CLD 6.3: Relationship between cloud service customer and cloud service provider
ISO 27017
CLD 6.3.1: Shared roles and responsibilities within a cloud computing environment
ISO 27017
CLD 8.1.5: Removal of cloud service customer assets
ISO 27017
A.8.2.1: Customer agreement
ISO 27701
4.2: Interested parties
ISO 27001

Listing offered digital services and naming owners

Critical
High
Normal
Low

The organization must maintain a list of digital services provided and the owners designated for them. The owner is responsible for completing the information in the service and for any other security measures that are closely related to the service.

The documentation related to the digital service includes e.g. the following information:

  • The type of digital service offered, the service category and the purpose of use
  • Data controller and related processing agreements
  • Key partners in the service supply chain and the distribution of security responsibilities (discussed in more detail in a separate task)
Connected other frameworks and requirements:
A.2.1: Obligation to co-operate regarding PII principals’ rights
ISO 27018
A.2: Consent and choice
ISO 27018
6: Organization of information security
ISO 27017
CLD 6.3: Relationship between cloud service customer and cloud service provider
ISO 27017
CLD 6.3.1: Shared roles and responsibilities within a cloud computing environment
ISO 27017
No items found.