ISO/IEC INTERNATIONAL STANDARD 19086-4 First edition 2019-01 Cloud computing Service level agreement (SLA) framework - Part 4: Components of security and of protection of PII Informatique en nuage - Cadre de travail de I'accord du niveau de service Partie 4: Eléments de sécurité et de protection des Pll Reference number IEC IS0/IEC 19086-4:2019(E) @IS0/IEC2019 IS0/IEC 19086-4:2019(E) COPYRIGHTPROTECTEDDOCUMENT @ IS0/IEC 2019 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either IsO at the address below or Iso's member body in the country of the requester. ISO copyright office CP 401 : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +4122 749 0111 Fax: +41 22 749 09 47 Email: [email protected] Website: www.iso.org Published in Switzerland ii @ IS0/IEC 2019 - All rights reserved IS0/IEC 19086-4:2019(E) Contents Page Foreword ..V Introduction. ...vi 1 Scope 2 Normative references ...1. 3 Terms and definitions 4 Symbols and abbreviated terms ..1 5 Relationship with other parts of the cloud computing SLA framework .2 5.1 General. 5.2 Conformance ..2 6 Overview .3 6.1 General .3 6.2 Structure of this document ..3 7 Information security components ..4 7.1 Information security policy component .4 7.1.1 Description... 7.1.2 Cloud service qualitative objectives 4 7.1.3 Guidance. ..4 7.2 Organization of information security component 4 7.2.1 Description. ..4 7.2.2 Cloud service qualitative objectives 4 7.2.3 Guidance. .4 7.3 Asset management component 4 7.3.1 Description. 4 7.3.2 Cloud service level objectives. .5 7.3.3 Cloud service qualitative objectives .5 7.3.4 .5 Guidance.. 7.4 Access control component. .5 7.4.1 .5 Description. 7.4.2 Cloud service level objectives. .5 7.4.3 Cloud service qualitative objectives . 6 7.4.4 Guidance. .6 7.5 Cryptography component. .7 7.5.1 Description. .7 7.5.2 Cloud service qualitative objectives .1 7.5.3 Guidance. .1 7.6 Physical and environmental security component .8 7.6.1 Description.. 7.6.2 Cloud service qualitative objectives .8 7.6.3 Guidance. .8 7.7 Operations security component .9 7.7.1 Description. .9 7.7.2 Cloud service level objectives .9 7.7.3 Cloud service qualitative objectives 9 7.7.4 Guidance.. .10 7.8 Communications security component. .10 7.8.1 Description.. .10 7.8.2 Cloud service qualitative objectives ..10 7.8.3 Guidance .10 7.9 Systems acquisition, development and maintenance component. ..10 7.9.1 Description. .10 7.9.2 Cloud service qualitative objectives ..11 7.9.3 Guidance .11 @ IS0/IEC 2019 - All rights reserved iii