Possible scenarios may include: Possible scenarios may include: Self-employed or business (0 to 9 employees) Medium business (50 to 249 employees) Small business (10 49 employees) with no designated IT function Large organisation (250 + employees) – Simple IT configuration single device storing ECC data. Any size organisation with a designated IT function – Simple IT configuration plus use of cloud services such as webmail Likely to include servers, networks, end user devices and firewalls. or cloud storage containing ECC data. More complex IT configuration with central management of services. Simple IT configuration plus a third party provider processing or Private or corporately managed cloud services used to store ECC storing ECC data. data. parties providing additional services and processing or storing ECC data. Securing data in the Cloud and checking third parties Business Category Corporate IT Category A wide range of online services require users to transfer data to Ensure that the CESG Cloud Security Principles are being adhered to. remote computing facilities commonly known as the cloud. Data – The principles are: being processed in the cloud represents a risk because the personal data you are responsible for leaves your network and be processed in Data in transit protection systems managed by your cloud provider. It is therefore important to Asset protection and resilience check that they have security measures in place: Separation between consumers Make sure you know what data is stored in the cloud, as modern Governance framework computing devices, especially those targeted at consumers, can Operational security have cloud backup or sync services switched on by default. Personnel security Ensure you know in country your cloud service provider hosts Secure development Supply chain security its data and whether the locations they use comply with the Secure consumer management requirements of the Data Protection Act 1998. Identity and authentication Check whether your cloud service provider complies with the External interface protection CESG Cloud Security Principles Secure service administration
Possible scenarios may include: Self-employed or business (0 to 9 employees) Small business (10 – 49 employees) with no designated IT function Simple IT configuration – single device storing ECC data. Simple IT configuration plus use of cloud services such as webmail or cloud storage containing ECC data. Simple IT configuration plus a third party provider processing or storing ECC data. Possible scenarios may include: Medium business (50 to 249 employees) Large organisation (250 + employees) Any size organisation with a designated IT function Likely to include servers, networks, end user devices and firewalls. More complex IT configuration with central management of services. Private or corporately managed cloud services used to store ECC data. parties providing additional services and processing or storing ECC data. Securing data in the Cloud and checking third parties Business Category Corporate IT Category A wide range of online services require users to transfer data to remote computing facilities – commonly known as the cloud. Data being processed in the cloud represents a risk because the personal data you are responsible for leaves your network and be processed in systems managed by your cloud provider. It is therefore important to check that they have security measures in place: Make sure you know what data is stored in the cloud, as modern computing devices, especially those targeted at consumers, can have cloud backup or sync services switched on by default. Ensure you know in country your cloud service provider hosts its data and whether the locations they use comply with the requirements of the Data Protection Act 1998. Check whether your cloud service provider complies with the CESG Cloud Security Principles Ensure that the CESG Cloud Security Principles are being adhered to. The principles are: Data in transit protection Asset protection and resilience Separation between consumers Governance framework Operational security Personnel security Secure development Supply chain security Secure consumer management Identity and authentication External interface protection Secure service administration
information-risk-questionnaire-self-assessment.docx