Control Mapping

This below table represents the responsibilities of the Cloud Service Provider (CSP) and End User (EU) in the Cloud Security as per the ISO27001:2013 Standard, and Cloud Security Standard.
*CSP – Cloud Service Provider
*EU – End User

ISO 27001:2013

IAAS

PAAS

SAAS

A.5

Information Security Policies

 To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.

CSP

A.6

Organization of information security

 To establish a management framework to initiate and control the implementation and operation of information security within the organization.

CSP

ISO 27001:2013	IAAS	PAAS	SAAS
 To ensure the security of teleworking and use of mobile devices.
A.7 Human Resource Security  To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.  To ensure that employees and contractors are aware of and fulfil their information security responsibilities.  To protect the organization’s interests as part of the process of changing or terminating employment.	CSP	CSP	CSP
A.8 Asset Management  To identify organizational assets and define appropriate protection responsibilities.  To ensure that information receives an appropriate level of protection in accordance with its importance to the organization.  To prevent unauthorized disclosure, modification, removal or destruction of information stored on media.	CSP, EU	CSP, EU	CSP
A.9 Access Control  To limit access to information and information processing facilities.  To ensure authorized user access and to prevent unauthorized access to systems and services.  To make users accountable for safeguarding their authentication information.  To prevent unauthorized access to systems and applications.	CSP, EU	CSP, EU	CSP, EU
A.10 Cryptography  To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information.	CSP, EU	CSP, EU	CSP
A.11 Physical & Environmental Security  To prevent unauthorized physical access, damage and interference to the organization’s information and information processing facilities.  To prevent loss, damage, theft or compromise of assets and interruption to the organization’s operations.	CSP	CSP	CSP
A.12 Operation Security	CSP, EU	CSP, EU	CSP

ISO 27001:2013	IAAS	PAAS	SAAS
 To ensure correct and secure operations of information processing facilities.  To ensure that information and information processing facilities are protected against malware.  To protect against loss of data.  To record events and generate evidence.  To ensure the integrity of operational systems.  To prevent exploitation of technical vulnerabilities.  To minimize the impact of audit activities on operational systems.
A.13 Communication Security  To ensure the protection of information in networks and its supporting information processing facilities.  To maintain the security of information transferred within an organization and with any external entity.	CSP, EU	CSP, EU	CSP
A.14 System acquisition, development and maintenance  To ensure that information security is an integral part of information systems across the entire lifecycle. This also includes the requirements for information systems which provide services over public networks.  To ensure that information security is designed and implemented within the development lifecycle of information systems.  To ensure the protection of data used for testing.	CSP, EU	CSP, EU	CSP
A.15 Supplier Relationships  To ensure protection of the organization’s assets that is accessible by suppliers.  To maintain an agreed level of information security and service delivery in line with supplier Agreements	CSP, EU	CSP, EU	CSP
A.16 Information security incident management  To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.	CSP	CSP	CSP
A.17 Information security aspects of business continuity management  Information security continuity shall be embedded in the organization’s business continuity management systems.  To ensure availability of information processing facilities.	CSP, EU	CSP, EU	CSP
A.18 Compliance	CSP, EU	CSP, EU	CSP, EU

ISO 27001:2013

IAAS

PAAS

SAAS

 To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security

and of any security requirements.

 To ensure that information security is implemented and operated in accordance with the organizational policies and procedures.

Cloud Security Standard	IAAS	PAAS	SAAS
AIS-01 Application & Interface Security Application Security	CSP,EU	CSP,EU	CSP
AIS-02 Application & Interface Security Customer Access Requirements	CSP,EU	CSP,EU	CSP
AIS-03 Application & Interface Security Data Integrity	CSP,EU	CSP,EU	CSP,EU
AIS-04 Application & Interface Security Data Security / Integrity	CSP,EU	CSP,EU	CSP,EU
AAC-01 Audit Assurance & Compliance Audit Planning	CSP,EU	CSP,EU	CSP,EU
AAC-02 Audit Assurance & Compliance Independent Audits	CSP,EU	CSP,EU	CSP,EU
AAC-03 Audit Assurance & Compliance Information System Regulatory Mapping	CSP	CSP	CSP
BCR-01 Business Continuity Management & Operational Resilience Business Continuity Planning	CSP	CSP	CSP
BCR-02 Business Continuity Management & Operational Resilience Business Continuity Testing	CSP	CSP	CSP
BCR-03 Business Continuity Management & Operational Resilience Datacenter Utilities / Environmental Conditions	CSP	CSP	CSP
BCR-04 Business Continuity Management & Operational Resilience Documentation	CSP	CSP	CSP
BCR-05 Business Continuity Management & Operational Resilience Environmental Risks	CSP	CSP	CSP
BCR-06 Business Continuity Management & Operational Resilience Equipment Location	CSP	CSP	CSP
BCR-07 Business Continuity Management & Operational Resilience Equipment Maintenance	CSP	CSP	CSP
BCR-08 Business Continuity Management & Operational Resilience Equipment Power Failures	CSP	CSP	CSP
BCR-09 Business Continuity Management & Operational Resilience Impact Analysis	CSP	CSP	CSP
BCR-10 Business Continuity Management & Operational Resilience Policy	CSP	CSP	CSP
BCR-11 Business Continuity Management & Operational Resilience Retention Policy	CSP	CSP	CSP
CCC-01 Change Control & Configuration Management New Development / Acquisition	CSP,EU	CSP,EU	CSP
CCC-02 Change Control & Configuration Management Outsourced Development	CSP,EU	CSP,EU	CSP
CCC-03 Change Control & Configuration Management Quality Testing	CSP,EU	CSP,EU	CSP,EU

Cloud Security Standard	IAAS	PAAS	SAAS
CCC-04 Change Control & Configuration Management Unauthorized Software Installations	CSP,EU	CSP,EU	CSP,EU
CCC-05 Change Control & Configuration Management Production Changes	CSP,EU	CSP,EU	CSP,EU
DSI-01 Data Security & Information Lifecycle Management Classification	CSP,EU	CSP,EU	CSP
DSI-02 Data Security & Information Lifecycle Management Data Inventory / Flows	CSP,EU	CSP,EU	CSP,EU
DSI-03 Data Security & Information Lifecycle Management Ecommerce Transactions	CSP,EU	CSP,EU	CSP
DSI-04 Data Security & Information Lifecycle Management Handling / Labeling / Security Policy	CSP	CSP	CSP
DSI-05 Data Security & Information Lifecycle Management Non- Production Data	CSP,EU	CSP,EU	CSP
DSI-06 Data Security & Information Lifecycle Management Ownership / Stewardship	CSP,EU	CSP,EU	CSP
DSI-07 Data Security & Information Lifecycle Management Secure Disposal	CSP	CSP	CSP
DCS-01 Datacenter Security Asset Management	CSP	CSP	CSP
DCS-02 Datacenter Security Controlled Access Points	CSP	CSP	CSP
DCS-03 Datacenter Security Equipment Identification	CSP	CSP	CSP
DCS-04 Datacenter Security Off-Site Authorization	CSP,EU	CSP,EU	CSP,EU
DCS-05 Datacenter Security Off-Site Equipment	CSP,EU	CSP,EU	CSP
DCS-06 Datacenter Security Policy	CSP	CSP	CSP
DCS-07 Datacenter Security Secure Area Authorization	CSP	CSP	CSP
DCS-08 Datacenter Security Unauthorized Persons Entry	CSP	CSP	CSP
DCS-09 Datacenter Security User Access	CSP,EU	CSP,EU	CSP,EU
EKM-01 Encryption & Key Management Entitlement	CSP,EU	CSP,EU	CSP
EKM-02 Encryption & Key Management Key Generation	CSP,EU	CSP,EU	CSP,EU
EKM-03 Encryption & Key Management Sensitive Data Protection	CSP,EU	CSP,EU	CSP,EU
EKM-04 Encryption & Key Management Storage and Access	CSP,EU	CSP,EU	CSP,EU
GRM-01 Governance and Risk Management Baseline Requirements	CSP,EU	CSP,EU	CSP
GRM-02 Governance and Risk Management Data Focus Risk Assessments	CSP	CSP	CSP
GRM-03 Governance and Risk Management Oversight	CSP	CSP	CSP
GRM-04 Governance and Risk Management Program	CSP	CSP	CSP
GRM-05 Governance and Risk Management Support/Involvement	CSP	CSP	CSP
GRM-06 Governance and Risk Management Policy	CSP	CSP	CSP
GRM-07 Governance and Risk Management Policy Enforcement	CSP,EU	CSP,EU	CSP,EU
GRM-08 Governance and Risk Management Policy Impact on Risk Assessments	CSP,EU	CSP,EU	CSP
GRM-09 Governance and Risk Management Policy Reviews	CSP	CSP	CSP
GRM-10 Governance and Risk Management Risk Assessments	CSP	CSP	CSP
GRM-11 Governance and Risk Management Risk Management Framework	CSP	CSP	CSP
HRS-01 Human Resources Asset Returns	CSP	CSP	CSP
HRS-02 Human Resources Background Screening	CSP	CSP	CSP

Cloud Security Standard	IAAS	PAAS	SAAS
HRS-03 Human Resources Employment Agreements	CSP	CSP	CSP
HRS-04 Human Resources Employment Termination	CSP	CSP	CSP
HRS-05 Human Resources Mobile Device Management	CSP,EU	CSP,EU	CSP,EU
HRS-06 Human Resources Non-Disclosure Agreements	CSP,EU	CSP,EU	CSP,EU
HRS-07 Human Resources Roles / Responsibilities	CSP,EU	CSP,EU	CSP,EU
HRS-08 Human Resources Technology Acceptable Use	CSP,EU	CSP,EU	CSP,EU
HRS-09 Human Resources Training / Awareness	CSP	CSP	CSP
HRS-10 Human Resources User Responsibility	CSP,EU	CSP,EU	CSP,EU
HRS-11 Human Resources Workspace	CSP	CSP	CSP
IAM-01 Identity & Access Management Audit Tools Access	CSP	CSP	CSP
IAM-02 Identity & Access Management Credential Lifecycle / Provision Management	CSP,EU	CSP,EU	CSP,EU
IAM-03 Identity & Access Management Diagnostic / Configuration Ports Access	CSP	CSP	CSP
IAM-04 Identity & Access Management Policies and Procedures	CSP	CSP	CSP
IAM-05 Identity & Access Management Segregation of Duties	CSP	CSP	CSP
IAM-06 Identity & Access Management Source Code Access Restriction	CSP	CSP	CSP,EU
IAM-07 Identity & Access Management Third Party Access	CSP,EU	CSP,EU	CSP,EU
IAM-08 Identity & Access Management Trusted Sources	CSP,EU	CSP,EU	CSP,EU
IAM-09 Identity & Access Management User Access Authorization	CSP,EU	CSP,EU	CSP
IAM-10 Identity & Access Management User Access Reviews	CSP,EU	CSP,EU	CSP
IAM-11 Identity & Access Management User Access Revocation	CSP,EU	CSP,EU	CSP,EU
IAM-12 Identity & Access Management User ID Credentials	EU	CSP,EU	CSP,EU
IAM-13 Identity & Access Management Utility Programs Access	EU	CSP,EU	CSP
IVS-01 Infrastructure & Virtualization Security Audit Logging / Intrusion Detection	CSP	CSP	CSP
IVS-02 Infrastructure & Virtualization Security Change Detection	CSP,EU	CSP,EU	CSP,EU
IVS-03 Infrastructure & Virtualization Security Clock Synchronization	CSP,EU	CSP,EU	CSP,EU
IVS-04 Infrastructure & Virtualization Security Information System Documentation	CSP	CSP	CSP
IVS-05 Infrastructure & Virtualization Security Vulnerability Management	CSP	CSP	CSP
IVS-06 Infrastructure & Virtualization Security Network Security	CSP	CSP	CSP
IVS-07 Infrastructure & Virtualization Security OS Hardening and Base Controls	CSP	CSP	CSP
IVS-08 Infrastructure & Virtualization Security Production / Non- Production Environments	CSP	CSP	CSP
IVS-09 Infrastructure & Virtualization Security Segmentation	CSP	CSP	CSP
IVS-10 Infrastructure & Virtualization Security VM Security - Data Protection	CSP	CSP	CSP
IVS-11 Infrastructure & Virtualization Security Hypervisor Hardening	CSP	CSP	CSP
IVS-12 Infrastructure & Virtualization Security Wireless Security	CSP	CSP	CSP
IVS-13 Infrastructure & Virtualization Security Network Architecture	CSP	CSP	CSP
IPY-01 Interoperability & Portability APIs	CSP,EU	CSP,EU	CSP,EU
IPY-02 Interoperability & Portability Data Request	CSP	CSP	CSP
IPY-03 Interoperability & Portability Policy & Legal	CSP	CSP	CSP

Cloud Security Standard	IAAS	PAAS	SAAS
IPY-04 Interoperability & Portability Standardized Network Protocols	CSP	CSP	CSP
IPY-05 Interoperability & Portability Virtualization	CSP	CSP	CSP
MOS-01 Mobile Security Anti-Malware	EU	CSP,EU	CSP,EU
MOS-02 Mobile Security Application Stores	EU	CSP,EU	CSP,EU
MOS-03 Mobile Security Approved Applications	EU	CSP,EU	CSP,EU
MOS-04 Mobile Security Approved Software for BYOD	CSP	CSP	CSP
MOS-05 Mobile Security Awareness and Training	CSP	CSP	CSP
MOS-06 Mobile Security Cloud Based Services	CSP,EU	CSP,EU	CSP,EU
MOS-07 Mobile Security Compatibility	CSP	CSP	CSP
MOS-08 Mobile Security Device Eligibility	EU	EU	CSP
MOS-09 Mobile Security Device Inventory	CSP	CSP	CSP
MOS-10 Mobile Security Device Management	CSP	CSP	CSP
MOS-11 Mobile Security Encryption	CSP	CSP	CSP
MOS-12 Mobile Security Jailbreaking and Rooting	EU	EU	EU
MOS-13 Mobile Security Legal	CSP	CSP	CSP
MOS-14 Mobile Security Lockout Screen	CSP	CSP	CSP
MOS-15 Mobile Security Operating Systems	CSP,EU	CSP,EU	CSP,EU
MOS-16 Mobile Security Passwords	EU	EU	EU
MOS-17 Mobile Security Policy	CSP	CSP	CSP
MOS-18 Mobile Security Remote Wipe	CSP,EU	CSP,EU	CSP,EU
MOS-19 Mobile Security Patches	EU	EU	EU
MOS-20 Mobile Security Users	CSP,EU	CSP,EU	CSP,EU
SEF-01 Security Incident Management, E-Discovery, & Cloud Forensics Contact / Authority Maintenance	CSP	CSP	CSP
SEF-02 Security Incident Management, E-Discovery, & Cloud Forensics Incident Management	CSP	CSP	CSP
SEF-03 Security Incident Management, E-Discovery, & Cloud Forensics Incident Reporting	CSP	CSP	CSP
SEF-04 Security Incident Management, E-Discovery, & Cloud Forensics Incident Response Legal Preparation	CSP	CSP	CSP
SEF-05 Security Incident Management, E-Discovery, & Cloud Forensics Incident Response Metrics	CSP	CSP	CSP
STA-01 Supply Chain Management, Transparency, and Accountability Data Quality and Integrity	CSP	CSP	CSP
STA-02 Supply Chain Management, Transparency, and Accountability Incident Reporting	CSP	CSP	CSP
STA-03 Supply Chain Management, Transparency, and Accountability Network / Infrastructure Services	CSP,EU	CSP,EU	CSP,EU
STA-04 Supply Chain Management, Transparency, and Accountability Provider Internal Assessments	CSP	CSP	CSP
STA-05 Supply Chain Management, Transparency, and Accountability Supply Chain Agreements	CSP,EU	CSP,EU	CSP,EU
STA-06 Supply Chain Management, Transparency, and Accountability Supply Chain Governance Reviews	CSP,EU	CSP,EU	CSP,EU
STA-07 Supply Chain Management, Transparency, and Accountability	CSP,EU	CSP,EU	CSP,EU

Cloud Security Standard	IAAS	PAAS	SAAS
Supply Chain Metrics
STA-08 Supply Chain Management, Transparency, and Accountability Third Party Assessment	CSP,EU	CSP,EU	CSP,EU
STA-09 Supply Chain Management, Transparency, and Accountability Third Party Audits	CSP,EU	CSP,EU	CSP,EU
TVM-01 Threat and Vulnerability Management Anti-Virus / Malicious Software	EU	EU	CSP
TVM-02 Threat and Vulnerability Management Vulnerability / Patch Management	EU	EU	CSP
TVM-03 Threat and Vulnerability Management Mobile Code	CSP,EU	CSP,EU	CSP,EU

Site Selection

24/7 Operation of Data Center - Temperature and Relative Humidity Control

Materials

General Paths of Access

Planning Detail

Computer Room

Entrance Rooms

Mechanical Room

Electrical Room and UPS Room

Fire Suppression Room

Circulation

Equipment Staging and Storage

Floor Slab

Computer Room Wall Construction

Fire-Rated Construction

Access Control Systems

Airborne Particles

Access Flooring System

Ceilings

Equipment Bracing System

Structural Building Code Compliance and Coordination

Structural Concerns Specific to Data Center Design

Introduction

Transformers

On Site Generation

Availability

Electrical Class Ratings

UPS System

Synchronization

UPS Output Switchboards

Ties and Interconnections

UPS Output Distribution

Power Distribution Units (PDUs)

Direct Current (DC) Power Systems

Computer Room Equipment Power Distribution

Load Management

Automation and Control, Monitoring

Bonding, Grounding, Lightning Protection, and Surge Suppression

Building Ground (Electrode) Ring

Labeling and Signage

Introduction

Data center network cabling design

Outside Plant Cabling Infrastructure

Aerial Service Pathways

Service Providers

Application cabling lengths

Telecommunications Cabling Infrastructure Classes

Cabling Topology

Cable Tray Support Systems

Overhead Cable Trays

Underfloor Cable Trays

Backbone Cabling

Cabling Types

Cabling Installation

Telecommunications and Computer Cabinets and Racks

Cabinet Airflow and Cabling Capacity

Cabinet and Rack Installation

Thermal Management in Cabinets

Introduction

Data center infrastructure Tiers

N - Base requirement

Concurrent maintainability and testing capability

Capacity and scalability

Isolation

Data center tiering

Secure Operation

Introduction

Cloud Deployment Model

Cloud Service Model

Facilities

Organization-Human resources

Cloud Infrastructure

Asset management and monitoring

Cloud Security

Physical Security

Network and Infrastructure Security

Applications and Database Security

Security and Compliance

Information Security

Security Operations and Management