Requirement
In addition to Subcontrols in the ECC control 2-7-3, the CSP shall cover the following additional Subcontrols for cybersecurity requirements for data and information protection requirements, as a minimum:
Sub-Controls
2-6-P-1-1
Requirement: Prohibiting the use of Cloud Technology Stack's data in any environment other than production environment, except after applying strict controls for protecting that data, such as data masking or data scrambling techniques.
2-6-P-1-2
Requirement: Provision to CSTs of securely data storage processes, procedures, and technologies to comply with related legal and regulatory requirements.
2-6-P-1-3
Requirement: Disposal of CST's data should be performed in a secure manner on termination or expiry of the contract with the CSP.
2-6-P-1-4
Requirement: Commitment to maintain the confidentiality of the CST's data and information, according to related legal and regulatory requirements.
2-6-P-1-5
Requirement: Providing CSTs with secure means to export and transfer data and virtual infrastructure.
References
- ECC – 2:2024 equivalent: 2-7-3
