Public relations

When offering cloud services, the organisation needs to have planned processes or procedures for:

• how the cloud service customer reports an information security event to the organisation
• how the organisation reports information security events to cloud service customers
• how the cloud service customer can track the status of a previously reported information security event

The organization lists the relevant government actors with whom it is important to actively contact and, if necessary, get in touch quickly. These authorities include national law enforcement and supervisory authorities.

A clear contact person should be defined for the relevant authorities to act as a contact point for the organization.

The organization shall actively maintain contacts with stakeholders relevant to the organization's operations and other relevant actors related to the organization's operations and security.

The goal is especially to:

• increase knowledge of best practices and keep up to date with relevant security information
• ensure that organisation's understanding of the security environment is up-to-date and complete