Requirement
[A: M | B: R] Cybersecurity requirements for the use of cloud computing and hosting services must be defined, documented and approved, ensuring compliance with relevant legislative and regulatory requirements. In addition to the applicable controls in main components (1) and (2) and subcomponent (3-1) necessary to protect the entity's data or the services provided to it, the requirements must cover at minimum:
Sub-Controls
3-2-1-1
Requirement: [A: M | B: R] Classifying data before hosting it with cloud computing and hosting service providers, and returning it to the entity (in a usable format) upon service termination.
3-2-1-2
Requirement: [A: M | B: R] Separation of the entity's environment (especially virtual servers) from other entities' environments in cloud computing services.
