Please state all IT / Data services that are outsourced to third parties, including cloud providers (please use a separate sheet if required): On demand service Service Vendor Name: (including Infrastructure, Platform or Software as a Service models) Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No What due diligence is undertaken before engaging with a new outsourced service provider (OSP)? Do you have a process for regular security audits on OSPs? Yes No data is processed or stored by 3rd party providers, how do you assess and manage the risks posed by shared infrastructure such as clouds or shared servers? For all on-demand services, is data stored in a private cloud? Yes No If to what extent are public clouds used and how is access to data controlled? ‘No’, If a data breach occurs, which party incurs the costs of notification and what is the OSP’s obligation in this situation? If an OSP system or service is unavailable, what is the likely impact on you? What contractual indemnities are in place in the event of a data breach or network unavailability caused/suffered by the OSP or cloud provider? How do your business continuity and/or disaster recovery plans address an OSP or cloud failure? E. Data Security
Please state all IT / Data services that are outsourced to third parties, including cloud providers (please use a separate sheet if required): Service Vendor Name: On demand service (including Infrastructure, Platform or Software as a Service models) Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No What due diligence is undertaken before engaging with a new outsourced service provider (OSP)? Do you have a process for regular security audits on OSPs? Yes No data is processed or stored by 3rd party providers, how do you assess and manage the risks posed by shared infrastructure such as clouds or shared servers? For all on-demand services, is data stored in a private cloud? Yes No If ‘No’, to what extent are public clouds used and how is access to data controlled? If a data breach occurs, which party incurs the costs of notification and what is the OSP’s obligation in this situation? If an OSP system or service is unavailable, what is the likely impact on you? What contractual indemnities are in place in the event of a data breach or network unavailability caused/suffered by the OSP or cloud provider? How do your business continuity and/or disaster recovery plans address an OSP or cloud failure? E. Data Security
cyberedge-proposal-form-word.docx