NCSC 14 Cloud Principles Gap Analysis Service

NCSC 14 Cloud Principles

Gap Analysis audit objectives

1. Data in transit protection

Verification that user data, transmitted over networks is adequately protected against tampering and eavesdropping.

2.Asset protection and resilience

Confirmation that user data, and the assets storing or processing the user data, are protected against physical tampering, loss, damage or seizure.

3.Separation between users

Confirmation that a malicious or compromised user of the service should not be able to affect the service or data of another.

4.Governance framework

Confirmation that the service provider should have a security governance framework which coordinates and directs its management of the service and information within it.

5.Operational security

Confirmation that the service is operated and managed securely, in order to impede, detect or prevent attacks.

6.Personnel security

Confirmation that where the service provider personnel have access to your data and systems there is a high degree of confidence in their trustworthiness.

7.Secure development

Verification that where services are designed and developed, there are actions taken to identify and mitigate threats to their security.

8.Supply chain security

Verification that the service provider ensures that its supply chain satisfactorily supports all of the security principles which the service claims to implement.

9.Secure user

Verification that the provider should make tools available for you to securely manage your use of their service.

10.Identity and authentication

Verification that access to service interfaces is constrained to authenticated and authorised individuals.

11.External interface protection

Confirmation that all external or less trusted interfaces of the service should be identified and appropriately defended.

12.Secure service administration

Confirmation that systems used for administration of a cloud service are protected by highly privileged access control, in operation for the service.

13.Audit information for users

Confirmation that audit records needed to monitor access to your service and the data held within it, are available and are of sufficient detail.

14.Secure use of the service

Confirmation that there are suitable operational instructions that tell users of their responsibilities when using the service in order for your data to be adequately protected.