{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["Intro","Information","Assessment","Conditional answers","Overview","TempResults"],"not_rendered":{"charts":6,"images":1,"macros":1,"external_links":1,"defined_names":20,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Intro","index":0,"n_rows":35,"n_cols":3,"rows_kept":35,"cut":false,"hidden":false,"merged":[[34,1,34,7],[24,1,24,7],[20,1,20,7],[28,1,28,7],[27,1,27,7],[33,1,33,7],[23,1,23,7],[26,1,26,7],[25,1,25,7],[3,1,3,7],[6,1,6,7],[7,0,7,1],[17,1,17,7],[8,2,8,7],[9,2,9,7],[10,2,10,7],[11,2,11,7],[12,2,12,7],[13,2,13,7],[14,2,14,7],[22,0,25,0],[18,1,18,7],[28,0,30,0],[31,1,31,7],[32,1,32,7],[19,1,19,7],[21,1,21,7],[22,1,22,7],[29,1,29,7],[30,1,30,7]]}
[]
["Smals Cloud Service Security Assessment Model"]
["VERSION:","2.5"]
["LICENSE:","Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License "]
[null,"http://creativecommons.org/licenses/by-nc-sa/4.0/"]
[]
[]
["Change tracking"]
["1.0","2014-11-28","First release"]
["2.0","2014-12-16","The ponderations are now locked"]
["2.1","2015-06-08","Some visual and security enhancements have been added"]
["2.2","2016-02-08","Correction of a ponderation"]
["2.3","2016-02-16","Correction related to the compliance with the cloud policy"]
["2.4","2016-04-19","Some visual and security enhancements have been added"]
["2.5","2017-06-28","Some modifications in the questions have been added"]
[]
["How to use this template:"]
["1.","The goal of this evaluation form is for a person (called assessor) to assess the security level of a cloud service offered by a Cloud Service Provider (CSP) according to 4 main criteria:\n- Governance\n- Identity and Access Management (IAM)\n- IT Security\n- Operational Security"]
["2.","Before filling the evaluation form, the assessor should be in possession of all the public information that can be found on the official website of the cloud service, especially a standard contract and all the available datasheets. We assume that the information found about the cloud service on the official website are correct."]
["3.","The \"Information\" tab should be filled with all the general info related to the assessment: cloud service name/provider/model, the name of the assessor, and the date of the assessment."]
["4.","The \"Assessment\" tab contains all the questions necessary for the evaluation of a cloud service."]
["4.1.","The column \"answer's value\" contains the relative score of each expected response for each question (over 100) as a reference. The cells containing the relative scores must not be changed."]
["4.2.","The column \"score\" has to be filled using the possible answers. "]
[null,"Note: The questions must be filled according to the given order, as some questions depend on the answers given in previous questions."]
[null,"Note: If a score is not applicable, the option \"N/A\" must be chosen. This will redistribute the weights to the other sub questions."]
[null,"Note: If the assessor does not know the answer to a question, the option \"Unknown\" must be chosen. This will give two different scores for one topic."]
["4.3.","Each question has been defined with a specific weight. From the scores of each question, the final weighted scores are automatically filled (in combination with the defined weights)."]
["4.4.","There are 2 different results: the minimal weighted score and the maximal weighted score.\n- The minimal weighted score corresponds to the situation where all the \"Unknown\" responses have been replaced by the worst answer. This is the worst case of the security evaluation, considering the uncertainty of the \"Unknown\" responses.\n- The maximal weighted score corresponds to the situation where all the \"Unknown\" responses have been replaced by the best answer. This is the best case of the security evaluation, considering the uncertainty of the \"Unknown\" responses."]
["4.5.","The two last columns grouped under \"compliance with cloud policy\" refer to the guarantees required by the cloud policy of the Social Security."]
[null,"The column \"ignoring the data type\" refers to the cloud policy guarantees that do not depend on the type of data to be stored in the cloud service."]
[null,"The column \"if personal, social or medical data\" refers to the additional cloud policy guarantees expected when the data to be stored in the cloud service are personal, social or medical."]
["5.","The \"Overview\" tab is a visual aide for the assessor."]
["5.1.","The chart represents the minimal and maximal weighted scores of each criterion."]
["5.2.","The donuts represent the compliance to the cloud policy per criterion when the data type is ignored."]
["6.","Be careful with the interpretation of the scores. This evaluation form is informative, and only a human judge should decide whether of not the evaluation is accurate enough. The human judge should contact the CSP of the cloud service if he needs additional information."]

{"sheet":"Information","index":1,"n_rows":7,"n_cols":3,"rows_kept":7,"cut":false,"hidden":false,"merged":[[0,1,0,2]]}
[null,"Cloud service informations"]
[]
[null,"Cloud service name:","<name>"]
[null,"Cloud service provider (CSP):","<CSP>"]
[null,"Cloud service model:","<choose a model>"]
[null,"Evaluated by:","<assessor name>"]
[null,"Evaluated date:","<dd/mm/yyyy>"]

{"sheet":"Assessment","index":2,"n_rows":655,"n_cols":14,"rows_kept":655,"cut":false,"hidden":false,"merged":[[0,1,0,13],[2,12,2,13]]}
[null,{"$f":"CONCATENATE(\"Assessment of \",Information!C3)","v":"Assessment of <name>"}]
[]
[null,"Category Title","Answer's value","Score","N/A?","Weight","Weight","Weight","Weight","Measured score","Minimal weighted score","Maximal weighted score","Compliance with cloud policy"]
[null,"For more information open the outline (+ / - ) left from row number","Possibility to put some description in the question's rows","Select appropriate range or value for every question (select N/A if not applicable)",null,"Fixed values per subsection","Dynamic values per subsection from N/A","Fixed values per section","Dynamic values per section from N/A",null,"Values computed automated","Values computed automated","Ignoring the data type","If personal, social or medical data"]
[1,"Governance",null,null,null,null,null,{"$f":"(H6+H67+H113+H170+H204)","v":1},{"$f":"(I6+I67+I113+I170+I204)","v":1},null,{"$f":"(K6+K67+K113+K170+K204)","v":0},{"$f":"(L6+L67+L113+L170+L204)","v":0}]
["1.1","Legal implication",null,null,1,{"$f":"(F7+F16+F25+F36+F48+F56)","v":1},{"$f":"(G7+G16+G25+G36+G48+G56)","v":1},0.24,{"$f":"IF(E6,H6*SUM($H$6,$H$67,$H$113,$H$170,$H$204,)/($E$6*$H$6+$E$67*$H$67+$E$113*$H$113+$E$170*$H$170+$E$204*$H$204),0)","v":0.24},null,{"$f":"(K7+K16+K25+K36+K48+K56)*I6/100","v":0},{"$f":"(L7+L16+L25+L36+L48+L56)*I6/100","v":0}]
["1.1.1","What is the physical location of data (at-rest and for processing)?",null,null,1,0.21,{"$f":"IF(E7,F7*SUM($F$7,$F$16,$F$25,$F$36,$F$48,$F$56,)/($E$7*$F$7+$E$16*$F$16+$E$25*$F$25+$E$36*$F$36+$E$48*$F$48+$E$56*$F$56),0)","v":0.21},null,null,{"$f":"IF(ISBLANK($D$7),0,VLOOKUP($D$7,$B$10:$C$14,2,0))","v":0},{"$f":"J7*G7","v":0},{"$f":"IF(ISBLANK(D7),0,IF(D7=\"Unknown\",100*G7,J7*G7))","v":0}]
[]
[null,"Score specification"]
[null,"The country of the assessor",100]
[null,"EU",75]
[null,"US",50]
[null,"Other",25]
[null,"Unknown",25]
[]
["1.1.2","Which jurisdiction is the CSP subject to? ",null,null,1,0.21,{"$f":"IF(E16,F16*SUM($F$7,$F$16,$F$25,$F$36,$F$48,$F$56,)/($E$7*$F$7+$E$16*$F$16+$E$25*$F$25+$E$36*$F$36+$E$48*$F$48+$E$56*$F$56),0)","v":0.21},null,null,{"$f":"IF(ISBLANK($D$16),0,VLOOKUP($D$16,$B$19:$C$23,2,0))","v":0},{"$f":"J16*G16","v":0},{"$f":"IF(ISBLANK(D16),0,IF(D16=\"Unknown\",100*G16,J16*G16))","v":0},{"$f":"IF(OR(D16=\"The country of the assessor\",D16=\"EU\"),\"V\",IF(D16=\"Unknown\",\"??\",\"X\"))","v":"X"}]
[]
[null,"Score specification"]
[null,"The country of the assessor",100]
[null,"EU",75]
[null,"US",50]
[null,"Other",25]
[null,"Unknown",25]
[]
["1.1.3","Can the CSP accomodate with the tenant's data retention requirements?",null,null,{"$f":"IF($D25=\"N/A\",0,1)","v":1},0.08,{"$f":"IF(E25,F25*SUM($F$7,$F$16,$F$25,$F$36,$F$48,$F$56,)/($E$7*$F$7+$E$16*$F$16+$E$25*$F$25+$E$36*$F$36+$E$48*$F$48+$E$56*$F$56),0)","v":0.08},null,null,{"$f":"IF(ISBLANK($D$25),0,VLOOKUP($D$25,$B$31:$C$34,2,0))","v":0},{"$f":"J25*G25","v":0},{"$f":"IF(ISBLANK(D25),0,IF(D25=\"Unknown\",100*G25,J25*G25))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. either do not store data more than a few months, or store data for several years."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.1.4","Can the data be given to governments if requested for judicial requirements without informing the tenant or without constitutional guarantees?",null,null,{"$f":"IF($D36=\"N/A\",0,1)","v":1},0.17,{"$f":"IF(E36,F36*SUM($F$7,$F$16,$F$25,$F$36,$F$48,$F$56,)/($E$7*$F$7+$E$16*$F$16+$E$25*$F$25+$E$36*$F$36+$E$48*$F$48+$E$56*$F$56),0)","v":0.17},null,null,{"$f":"IF(ISBLANK($D$36),0,VLOOKUP($D$36,$B$43:$C$46,2,0))","v":0},{"$f":"J36*G36","v":0},{"$f":"IF(ISBLANK(D36),0,IF(D36=\"Unknown\",100*G36,J36*G36))","v":0},{"$f":"IF(D36=\"No\",\"V\",IF(D36=\"Unknown\",\"??\",IF(D36=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The jurisdiction of the CSP should be taken into account."]
[null,"E.g. if the Patriot Act applies."]
[]
[null,"Score specification"]
[null,"Yes",0]
[null,"No",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.1.5","Can the data be given to, shared with third parties, or used by the CSP for other purposes than the cloud service without the tenant’s consent?",null,null,{"$f":"IF($D48=\"N/A\",0,1)","v":1},0.25,{"$f":"IF(E48,F48*SUM($F$7,$F$16,$F$25,$F$36,$F$48,$F$56,)/($E$7*$F$7+$E$16*$F$16+$E$25*$F$25+$E$36*$F$36+$E$48*$F$48+$E$56*$F$56),0)","v":0.25},null,null,{"$f":"IF(ISBLANK($D$48),0,VLOOKUP($D$48,$B$51:$C$54,2,0))","v":0},{"$f":"J48*G48","v":0},{"$f":"IF(ISBLANK(D48),0,IF(D48=\"Unknown\",100*G48,J48*G48))","v":0},{"$f":"IF(D48=\"No\",\"V\",IF(D48=\"Unknown\",\"??\",IF(D48=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",0]
[null,"No",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.1.6","If the US-EU Safe Harbor or Privacy Shield apply, is the CSP registered?",null,null,{"$f":"IF($D56=\"N/A\",0,1)","v":1},0.08,{"$f":"IF(E56,F56*SUM($F$7,$F$16,$F$25,$F$36,$F$48,$F$56,)/($E$7*$F$7+$E$16*$F$16+$E$25*$F$25+$E$36*$F$36+$E$48*$F$48+$E$56*$F$56),0)","v":0.08},null,null,{"$f":"IF(ISBLANK($D$56),0,VLOOKUP($D$56,$B$62:$C$65,2,0))","v":0},{"$f":"J56*G56","v":0},{"$f":"IF(ISBLANK(D56),0,IF(D56=\"Unknown\",100*G56,J56*G56))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"This applies only to US CSP."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.2","Supply chain management",null,null,1,{"$f":"(F68+F79+F90+F102)","v":1},{"$f":"(G68+G79+G90+G102)","v":1},0.22,{"$f":"IF(E67,H67*SUM($H$6,$H$67,$H$113,$H$170,$H$204,)/($E$6*$H$6+$E$67*$H$67+$E$113*$H$113+$E$170*$H$170+$E$204*$H$204),0)","v":0.22},null,{"$f":"(K68+K79+K90+K102)*I67/100","v":0},{"$f":"(L68+L79+L90+L102)*I67/100","v":0}]
["1.2.1","Does the CSP use subcontrators?",null,null,{"$f":"IF($D68=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E68,F68*SUM($F$68,$F$79,$F$90,$F$102,)/($E$68*$F$68+$E$79*$F$79+$E$90*$F$90+$E$102*$F$102),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$68),0,VLOOKUP($D$68,$B$75:$C$77,2,0))","v":0},{"$f":"J68*G68","v":0},{"$f":"IF(ISBLANK(D68),0,IF(D68=\"Unknown\",100*G68,J68*G68))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"A subcontractor can be used for outsourced work."]
[null,"This is not a penalizing question, except if the answer is unknown."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",100]
[null,"Unknown",50]
[]
["1.2.2","If so, will the CSP inform the tenant of the subcontractors hired to provide the cloud service?",null,null,{"$f":"IF($D79=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E79,F79*SUM($F$68,$F$79,$F$90,$F$102,)/($E$68*$F$68+$E$79*$F$79+$E$90*$F$90+$E$102*$F$102),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$79),0,VLOOKUP($D$79,$B$85:$C$88,2,0))","v":0},{"$f":"J79*G79","v":0},{"$f":"IF(ISBLANK(D79),0,IF(D79=\"Unknown\",100*G79,J79*G79))","v":0},{"$f":"IF(AND(D68=\"Yes\",D79=\"Yes\"),\"V\",IF(OR(D68=\"No\",D79=\"N/A\"),\"N/A\",IF(D79=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question will depend on the answer of question 1.2.1."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.2.3","If so, will the CSP inform the tenant of any change in the course of the contract?",null,null,{"$f":"IF($D$90=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E90,F90*SUM($F$68,$F$79,$F$90,$F$102,)/($E$68*$F$68+$E$79*$F$79+$E$90*$F$90+$E$102*$F$102),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$90),0,VLOOKUP($D$90,$B$97:$C$100,2,0))","v":0},{"$f":"J90*G90","v":0},{"$f":"IF(ISBLANK(D90),0,IF(D90=\"Unknown\",100*G90,J90*G90))","v":0},{"$f":"IF(AND(D68=\"Yes\",D90=\"Yes\"),\"V\",IF(OR(D68=\"No\",D90=\"N/A\"),\"N/A\",IF(D90=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question will depend on the answer of question 1.2.1."]
[null,"E.g. hiring a new subcontractor."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.2.4","If so, does the CSP guarantee contractually to remain fully responsible for his engagements, even with the hiring of subcontractors?",null,null,{"$f":"IF($D$102=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E102,F102*SUM($F$68,$F$79,$F$90,$F$102,)/($E$68*$F$68+$E$79*$F$79+$E$90*$F$90+$E$102*$F$102),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$102),0,VLOOKUP($D$102,$B$108:$C$111,2,0))","v":0},{"$f":"J102*G102","v":0},{"$f":"IF(ISBLANK(D102),0,IF(D102=\"Unknown\",100*G102,J102*G102))","v":0},{"$f":"IF(AND(D68=\"Yes\",D102=\"Yes\"),\"V\",IF(OR(D68=\"No\",D102=\"N/A\"),\"N/A\",IF(D102=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question will depend on the answer of question 1.2.1."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.3","Audit",null,null,1,{"$f":"(F114+F124+F135+F145+F156)","v":1},{"$f":"(G114+G124+G135+G145+G156)","v":1},0.15,{"$f":"IF(E113,H113*SUM($H$6,$H$67,$H$113,$H$170,$H$204,)/($E$6*$H$6+$E$67*$H$67+$E$113*$H$113+$E$170*$H$170+$E$204*$H$204),0)","v":0.15},null,{"$f":"(K114+K124+K135+K145+K156)*I113/100","v":0},{"$f":"(L114+L124+L135+L145+L156)*I113/100","v":0}]
["1.3.1","At which time interval is the cloud service (including all its subcontractors) audited by a third party?",null,null,{"$f":"IF($D114=\"N/A\",0,1)","v":1},0.17,{"$f":"IF(E114,F114*SUM($F$114,$F$124,$F$135,$F$145,$F$156,)/($E$114*$F$114+$E$124*$F$124+$E$135*$F$135+$E$145*$F$145+$E$156*$F$156),0)","v":0.17},null,null,{"$f":"IF(ISBLANK($D$114),0,VLOOKUP($D$114,$B$117:$C$122,2,0))","v":0},{"$f":"J114*G114","v":0},{"$f":"IF(ISBLANK(D114),0,IF(D114=\"Unknown\",100*G114,J114*G114))","v":0},{"$f":"IF(OR(D114=\"\",D114=\"Never\"),\"X\",IF(D114=\"Unknown\",\"??\",\"V\"))","v":"X"}]
[]
[null,"Score specification"]
[null,"≤ 6 months",100]
[null,"1 year",75]
[null,"2 years",35]
[null,"> 2 years",10]
[null,"Never",0]
[null,"Unknown",0]
[]
["1.3.2","If the cloud service is audited, are the scopes of the audits accurately defined?",null,null,{"$f":"IF($D$124=\"N/A\",0,1)","v":1},0.32,{"$f":"IF(E124,F124*SUM($F$114,$F$124,$F$135,$F$145,$F$156,)/($E$114*$F$114+$E$124*$F$124+$E$135*$F$135+$E$145*$F$145+$E$156*$F$156),0)","v":0.32},null,null,{"$f":"IF(ISBLANK($D$124),0,VLOOKUP($D$124,$B$130:$C$133,2,0))","v":0},{"$f":"J124*G124","v":0},{"$f":"IF(ISBLANK(D124),0,IF(D124=\"Unknown\",100*G124,J124*G124))","v":0},{"$f":"IF(D124=\"Yes\",\"V\",IF(D124=\"Unknown\",\"??\",IF(D124=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question will depend on the answer of question 1.3.1."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.3.3","At which time interval is the cloud service (including all its subcontractors) pen-tested?",null,null,{"$f":"IF($D135=\"N/A\",0,1)","v":1},0.17,{"$f":"IF(E135,F135*SUM($F$114,$F$124,$F$135,$F$145,$F$156,)/($E$114*$F$114+$E$124*$F$124+$E$135*$F$135+$E$145*$F$145+$E$156*$F$156),0)","v":0.17},null,null,{"$f":"IF(ISBLANK($D$135),0,VLOOKUP($D$135,$B$138:$C$143,2,0))","v":0},{"$f":"J135*G135","v":0},{"$f":"IF(ISBLANK(D135),0,IF(D135=\"Unknown\",100*G135,J135*G135))","v":0},{"$f":"IF(OR(D135=\"\",D135=\"Never\"),\"X\",IF(D135=\"Unknown\",\"??\",\"V\"))","v":"X"}]
[]
[null,"Score specification"]
[null,"3 months",100]
[null,"6 months",75]
[null,"1 year",35]
[null,"> 1 year",10]
[null,"Never",0]
[null,"Unknown",0]
[]
["1.3.4","Did the cloud service define an ISP (Information Security Policy) and obtain a security-related certification?",null,null,{"$f":"IF($D145=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E145,F145*SUM($F$114,$F$124,$F$135,$F$145,$F$156,)/($E$114*$F$114+$E$124*$F$124+$E$135*$F$135+$E$145*$F$145+$E$156*$F$156),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$145),0,VLOOKUP($D$145,$B$151:$C$154,2,0))","v":0},{"$f":"J145*G145","v":0},{"$f":"IF(ISBLANK(D145),0,IF(D145=\"Unknown\",100*G145,J145*G145))","v":0},{"$f":"IF(OR(D145=\"Yes, only an ISP\",D145=\"Yes, ISP and certificate(s)\"),\"V\",IF(D145=\"Unknown\",\"??\",\"X\"))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. certificates PCI DSS, HIPAA, ISO 27000, COBIT, SSAE16, SOC2/3, or norm ISAE 3402."]
[]
[null,"Score specification"]
[null,"Yes, only an ISP",60]
[null,"Yes, ISP and certificate(s)",100]
[null,"No ISP, no certificate",0]
[null,"Unknown",0]
[]
["1.3.5","Is there a Tier certification of data centers (especially for physical availability and security) or equivalent certification?",null,null,{"$f":"IF($D$156=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E156,F156*SUM($F$114,$F$124,$F$135,$F$145,$F$156,)/($E$114*$F$114+$E$124*$F$124+$E$135*$F$135+$E$145*$F$145+$E$156*$F$156),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$156),0,VLOOKUP($D$156,$B$162:$C$168,2,0))","v":0},{"$f":"J156*G156","v":0},{"$f":"IF(ISBLANK(D156),0,IF(D156=\"Unknown\",100*G156,J156*G156))","v":0},{"$f":"IF(OR(D156=\"No Tier Certification or equivalent\",D156=\"\"),\"X\",IF(D156=\"Unknown\",\"??\",IF(D156=\"N/A\",\"N/A\",\"V\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The documents related to the Tier certification can be found at: http://uptimeinstitute.com/"]
[]
[null,"Score specification"]
[null,"Tier 1 or equivalent",25]
[null,"Tier 2 or equivalent",50]
[null,"Tier 3 or equivalent",85]
[null,"Tier 4 or equivalent",100]
[null,"No Tier certification or equivalent",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.4","Business continuity",null,null,{"$f":"IF(AND($D$171=\"N/A\",$D$179=\"N/A\",$D$191=\"N/A\"),0,1)","v":1},{"$f":"(F171+F179+F191)","v":1},{"$f":"(G171+G179+G191)","v":1},0.24,{"$f":"IF(E170,H170*SUM($H$6,$H$67,$H$113,$H$170,$H$204,)/($E$6*$H$6+$E$67*$H$67+$E$113*$H$113+$E$170*$H$170+$E$204*$H$204),0)","v":0.24},null,{"$f":"(K171+K179+K191)*I170/100","v":0},{"$f":"(L171+L179+L191)*I170/100","v":0}]
["1.4.1","Is the cloud service delivery managed under SLAs (Service Level Agreements)?",null,null,{"$f":"IF($D171=\"N/A\",0,1)","v":1},0.33,{"$f":"IF(E171,F171*SUM($F$171,$F$179,$F$191,)/($E$171*$F$171+$E$179*$F$179+$E$191*$F$191),0)","v":0.33},null,null,{"$f":"IF(ISBLANK($D$171),0,VLOOKUP($D$171,$B$174:$C$177,2,0))","v":0},{"$f":"J171*G171","v":0},{"$f":"IF(ISBLANK(D171),0,IF(D171=\"Unknown\",100*G171,J171*G171))","v":0},{"$f":"IF(D171=\"Yes\",\"V\",IF(D171=\"Unknown\",\"??\",IF(D171=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.4.2","Does the CSP define and implement a business continuity plan?",null,null,{"$f":"IF($D179=\"N/A\",0,1)","v":1},0.33,{"$f":"IF(E179,F179*SUM($F$171,$F$179,$F$191,)/($E$171*$F$171+$E$179*$F$179+$E$191*$F$191),0)","v":0.33},null,null,{"$f":"IF(ISBLANK($D$179),0,VLOOKUP($D$179,$B$186:$C$189,2,0))","v":0},{"$f":"J179*G179","v":0},{"$f":"IF(ISBLANK(D179),0,IF(D179=\"Unknown\",100*G179,J179*G179))","v":0},{"$f":"IF(D179=\"Yes\",\"V\",IF(D179=\"Unknown\",\"??\",IF(D179=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"This refers to the continuity of the service in case of incident."]
[null,"E.g. British Standard BS 25999 certificate for business continuity management."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.4.3","Is the reversibility of the cloud service provided?",null,null,{"$f":"IF($D191=\"N/A\",0,1)","v":1},0.34,{"$f":"IF(E191,F191*SUM($F$171,$F$179,$F$191,)/($E$171*$F$171+$E$179*$F$179+$E$191*$F$191),0)","v":0.34},null,null,{"$f":"IF(ISBLANK($D$191),0,VLOOKUP($D$191,$B$197:$C$202,2,0))","v":0},{"$f":"J191*G191","v":0},{"$f":"IF(ISBLANK(D191),0,IF(D191=\"Unknown\",100*G191,J191*G191))","v":0},{"$f":"IF(OR(D191=\"\",D191=\"No\"),\"X\",IF(D191=\"Unknown\",\"??\",IF(D191=\"N/A\",\"N/A\",\"V\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The cloud service should not be a \"vendor lock-in\" service. The data should be in a standard format, and the data recovery should be automated as much as possible to help a potential migration to a new CSP."]
[]
[null,"Score specification"]
[null,"No",0]
[null,"Yes with an \"exit clause\"",60]
[null,"Yes with a regular and cost-efficient recovery of the data",80]
[null,"Yes with a regular and cost-efficient recovery of the data in a structured and documented format",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.5","Others",null,null,{"$f":"IF(AND($D$205=\"N/A\",$D$213=\"N/A\"),0,1)","v":1},{"$f":"(F205+F213)","v":1},{"$f":"(G205+G213)","v":1},0.15,{"$f":"IF(E204,H204*SUM($H$6,$H$67,$H$113,$H$170,$H$204,)/($E$6*$H$6+$E$67*$H$67+$E$113*$H$113+$E$170*$H$170+$E$204*$H$204),0)","v":0.15},null,{"$f":"(K205+K213)*I204/100","v":0},{"$f":"(L205+L213)*I204/100","v":0}]
["1.5.1","Does the CSP apply a segregation of duties in the CSP organization to protect the tenants?",null,null,{"$f":"IF($D205=\"N/A\",0,1)","v":1},0.5,{"$f":"IF(E205,F205*SUM($F$205,$F$213,)/($E$205*$F$205+$E$213*$F$213),0)","v":0.5},null,null,{"$f":"IF(ISBLANK($D$205),0,VLOOKUP($D$205,$B$208:$C$211,2,0))","v":0},{"$f":"J205*G205","v":0},{"$f":"IF(ISBLANK(D205),0,IF(D205=\"Unknown\",100*G205,J205*G205))","v":0}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.5.2","If meta-data are extracted by the CSP from the process of tenant's data, are they used for the cloud service only?",null,null,{"$f":"IF($D213=\"N/A\",0,1)","v":1},0.5,{"$f":"IF(E213,F213*SUM($F$205,$F$213,)/($E$205*$F$205+$E$213*$F$213),0)","v":0.5},null,null,{"$f":"IF(ISBLANK($D$213),0,VLOOKUP($D$213,$B$216:$C$219,2,0))","v":0},{"$f":"J213*G213","v":0},{"$f":"IF(ISBLANK(D213),0,IF(D213=\"Unknown\",100*G213,J213*G213))","v":0}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
[2,"Identity and Access Management (IAM)",null,null,null,null,null,{"$f":"(H222+H281+H323)","v":1},{"$f":"(I222+I281+I323)","v":1},null,{"$f":"(K222+K281+K323)","v":0},{"$f":"(L222+L281+L323)","v":0}]
["2.1","Authentication level",null,null,{"$f":"IF(AND($D$223=\"N/A\",$D$234=\"N/A\",$D$248=\"N/A\",$D$259=\"N/A\",$D$270=\"N/A\"),0,1)","v":1},{"$f":"(F223+F234+F248+F259+F270)","v":1},{"$f":"(G223+G234+G248+G259+G270)","v":1},0.34,{"$f":"IF(E222,H222*SUM($H$222,$H$281,$H$323,)/($E$222*$H$222+$E$281*$H$281+$E$323*$H$323),0)","v":0.34},null,{"$f":"(K223+K234+K248+K259+K270)*I222/100","v":0},{"$f":"(L223+L234+L248+L259+L270)*I222/100","v":0}]
["2.1.1","Are the different authentication mechanisms to access the cloud service documented?",null,null,{"$f":"IF($D223=\"N/A\",0,1)","v":1},0.36,{"$f":"IF(E223,F223*SUM($F$223,$F$234,$F$248,$F$259,$F$270,)/($E$223*$F$223+$E$234*$F$234+$E$248*$F$248+$E$259*$F$259+$E$270*$F$270),0)","v":0.36},null,null,{"$f":"IF(ISBLANK($D$223),0,VLOOKUP($D$223,$B$229:$C$232,2,0))","v":0},{"$f":"J223*G223","v":0},{"$f":"IF(ISBLANK(D223),0,IF(D223=\"Unknown\",100*G223,J223*G223))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. the tenant and tenant’s users."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.1.2","What is the strongest authentication mechanism to access the cloud service as a tenant system administrator offered by the CSP?",null,null,{"$f":"IF($D234=\"N/A\",0,1)","v":1},0.16,{"$f":"IF(E234,F234*SUM($F$223,$F$234,$F$248,$F$259,$F$270,)/($E$223*$F$223+$E$234*$F$234+$E$248*$F$248+$E$259*$F$259+$E$270*$F$270),0)","v":0.16},null,null,{"$f":"IF(ISBLANK($D$234),0,VLOOKUP($D$234,$B$240:$C$246,2,0))","v":0},{"$f":"J234*G234","v":0},{"$f":"IF(ISBLANK(D234),0,IF(D234=\"Unknown\",100*G234,J234*G234))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. to create a tenant account."]
[]
[null,"Score specification"]
[null,"No authentication",0]
[null,"Username + password",10]
[null,"Username + password + token (e.g. with SMS)",75]
[null,"Username + password + digital certificate",90]
[null,"Username + password + certificate/token + location",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.1.3","What is the strongest authentication mechanism to access the cloud service as a tenant user offered by the CSP?",null,null,{"$f":"IF($D248=\"N/A\",0,1)","v":1},0.16,{"$f":"IF(E248,F248*SUM($F$223,$F$234,$F$248,$F$259,$F$270,)/($E$223*$F$223+$E$234*$F$234+$E$248*$F$248+$E$259*$F$259+$E$270*$F$270),0)","v":0.16},null,null,{"$f":"IF(ISBLANK($D$248),0,VLOOKUP($D$248,$B$251:$C$257,2,0))","v":0},{"$f":"J248*G248","v":0},{"$f":"IF(ISBLANK(D248),0,IF(D248=\"Unknown\",100*G248,J248*G248))","v":0}]
[]
[null,"Score specification"]
[null,"No authentication",0]
[null,"Username + password",20]
[null,"Username + password + token (e.g. with SMS)",75]
[null,"Username + password + digital certificate",90]
[null,"Username + password + certificate/token + location",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.1.4","Are password policy enforcements well-defined and implemented?",null,null,{"$f":"IF($D259=\"N/A\",0,1)","v":1},0.16,{"$f":"IF(E259,F259*SUM($F$223,$F$234,$F$248,$F$259,$F$270,)/($E$223*$F$223+$E$234*$F$234+$E$248*$F$248+$E$259*$F$259+$E$270*$F$270),0)","v":0.16},null,null,{"$f":"IF(ISBLANK($D$259),0,VLOOKUP($D$259,$B$265:$C$268,2,0))","v":0},{"$f":"J259*G259","v":0},{"$f":"IF(ISBLANK(D259),0,IF(D259=\"Unknown\",100*G259,J259*G259))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. to change password each month."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.1.5","Are secure password reset procedures well-defined and implemented?",null,null,{"$f":"IF($D270=\"N/A\",0,1)","v":1},0.16,{"$f":"IF(E270,F270*SUM($F$223,$F$234,$F$248,$F$259,$F$270,)/($E$223*$F$223+$E$234*$F$234+$E$248*$F$248+$E$259*$F$259+$E$270*$F$270),0)","v":0.16},null,null,{"$f":"IF(ISBLANK($D$270),0,VLOOKUP($D$270,$B$276:$C$279,2,0))","v":0},{"$f":"J270*G270","v":0},{"$f":"IF(ISBLANK(D270),0,IF(D270=\"Unknown\",100*G270,J270*G270))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. if a tenant user does not remember his/her password, the procedure should ask the user to reset the password, not email the user with the actual password."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2","User management",null,null,{"$f":"IF(AND($D$282=\"N/A\",$D$290=\"N/A\",$D$301=\"N/A\",$D$312=\"N/A\"),0,1)","v":1},{"$f":"(F282+F290+F301+F312)","v":1},{"$f":"(G282+G290+G301+G312)","v":1},0.33,{"$f":"IF(E281,H281*SUM($H$222,$H$281,$H$323,)/($E$222*$H$222+$E$281*$H$281+$E$323*$H$323),0)","v":0.33},null,{"$f":"(K282+K290+K301+K312)*I281/100","v":0},{"$f":"(L282+L290+L301+L312)*I281/100","v":0}]
["2.2.1","Who performs the tenants’ user management?",null,null,{"$f":"IF($D282=\"N/A\",0,1)","v":1},0.22,{"$f":"IF(E282,F282*SUM($F$282,$F$290,$F$301,$F$312,)/($E$282*$F$282+$E$290*$F$290+$E$301*$F$301+$E$312*$F$312),0)","v":0.22},null,null,{"$f":"IF(ISBLANK($D$282),0,VLOOKUP($D$282,$B$285:$C$288,2,0))","v":0},{"$f":"J282*G282","v":0},{"$f":"IF(ISBLANK(D282),0,IF(D282=\"Unknown\",100*G282,J282*G282))","v":0}]
[]
[null,"Score specification"]
[null,"Tenant system administrator",100]
[null,"CSP",20]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.2","Is the integration with the IAM of the tenant possible?",null,null,{"$f":"IF($D290=\"N/A\",0,1)","v":1},0.35,{"$f":"IF(E290,F290*SUM($F$282,$F$290,$F$301,$F$312,)/($E$282*$F$282+$E$290*$F$290+$E$301*$F$301+$E$312*$F$312),0)","v":0.35},null,null,{"$f":"IF(ISBLANK($D$290),0,VLOOKUP($D$290,$B$296:$C$299,2,0))","v":0},{"$f":"J290*G290","v":0},{"$f":"IF(ISBLANK(D290),0,IF(D290=\"Unknown\",100*G290,J290*G290))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with LDAP/AD."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.3","Is the integration with an ID-provider possible?",null,null,{"$f":"IF($D301=\"N/A\",0,1)","v":1},0.28000000000000003,{"$f":"IF(E301,F301*SUM($F$282,$F$290,$F$301,$F$312,)/($E$282*$F$282+$E$290*$F$290+$E$301*$F$301+$E$312*$F$312),0)","v":0.28000000000000003},null,null,{"$f":"IF(ISBLANK($D$301),0,VLOOKUP($D$301,$B$307:$C$310,2,0))","v":0},{"$f":"J301*G301","v":0},{"$f":"IF(ISBLANK(D301),0,IF(D301=\"Unknown\",100*G301,J301*G301))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with FAS (Federal Authentication Service)."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.4","Are the identification and/or authentication of the devices used to access the cloud service possible as additional enforcement of the IAM?",null,null,{"$f":"IF($D312=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E312,F312*SUM($F$282,$F$290,$F$301,$F$312,)/($E$282*$F$282+$E$290*$F$290+$E$301*$F$301+$E$312*$F$312),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$312),0,VLOOKUP($D$312,$B$318:$C$321,2,0))","v":0},{"$f":"J312*G312","v":0},{"$f":"IF(ISBLANK(D312),0,IF(D312=\"Unknown\",100*G312,J312*G312))","v":0},{"$f":"IF(D312=\"Yes\",\"V\",IF(D312=\"Unknown\",\"??\",IF(D312=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. via the IP address of a computer."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.3","Access management",null,null,{"$f":"IF(AND($D$324=\"N/A\",$D$332=\"N/A\",$D$340=\"N/A\",$D$348=\"N/A\"),0,1)","v":1},{"$f":"(F324+F332+F340+F348)","v":1},{"$f":"(G324+G332+G340+G348)","v":1},0.33,{"$f":"IF(E323,H323*SUM($H$222,$H$281,$H$323,)/($E$222*$H$222+$E$281*$H$281+$E$323*$H$323),0)","v":0.33},null,{"$f":"(K324+K332+K340+K348)*I323/100","v":0},{"$f":"(L324+L332+L340+L348)*I323/100","v":0}]
["2.3.1","Does the CSP document how the IAM of its employees related to the tenants’ assets is performed?",null,null,{"$f":"IF($D324=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E324,F324*SUM($F$324,$F$332,$F$340,$F$348,)/($E$324*$F$324+$E$332*$F$332+$E$340*$F$340+$E$348*$F$348),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$324),0,VLOOKUP($D$324,$B$327:$C$330,2,0))","v":0},{"$f":"J324*G324","v":0},{"$f":"IF(ISBLANK(D324),0,IF(D324=\"Unknown\",100*G324,J324*G324))","v":0}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.3.2","Is data access of {tenant user, tenant system administrator, CSP system administrator} clearly defined?",null,null,{"$f":"IF($D332=\"N/A\",0,1)","v":1},0.28000000000000003,{"$f":"IF(E332,F332*SUM($F$324,$F$332,$F$340,$F$348,)/($E$324*$F$324+$E$332*$F$332+$E$340*$F$340+$E$348*$F$348),0)","v":0.28000000000000003},null,null,{"$f":"IF(ISBLANK($D$332),0,VLOOKUP($D$332,$B$335:$C$338,2,0))","v":0},{"$f":"J332*G332","v":0},{"$f":"IF(ISBLANK(D332),0,IF(D332=\"Unknown\",100*G332,J332*G332))","v":0},{"$f":"IF(D332=\"Yes\",\"V\",IF(D332=\"Unknown\",\"??\",IF(D332=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.3.3","Is data access of {CSP employees, third party, other tenants} denied?",null,null,{"$f":"IF($D340=\"N/A\",0,1)","v":1},0.35,{"$f":"IF(E340,F340*SUM($F$324,$F$332,$F$340,$F$348,)/($E$324*$F$324+$E$332*$F$332+$E$340*$F$340+$E$348*$F$348),0)","v":0.35},null,null,{"$f":"IF(ISBLANK($D$340),0,VLOOKUP($D$340,$B$343:$C$346,2,0))","v":0},{"$f":"J340*G340","v":0},{"$f":"IF(ISBLANK(D340),0,IF(D340=\"Unknown\",100*G340,J340*G340))","v":0},{"$f":"IF(D340=\"Yes\",\"V\",IF(D340=\"Unknown\",\"??\",IF(D340=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.3.4","Is IAM management and data access logging clearly defined and available?",null,null,{"$f":"IF($D348=\"N/A\",0,1)","v":1},0.22,{"$f":"IF(E348,F348*SUM($F$324,$F$332,$F$340,$F$348,)/($E$324*$F$324+$E$332*$F$332+$E$340*$F$340+$E$348*$F$348),0)","v":0.22},null,null,{"$f":"IF(ISBLANK($D$348),0,VLOOKUP($D$348,$B$351:$C$354,2,0))","v":0},{"$f":"J348*G348","v":0},{"$f":"IF(ISBLANK(D348),0,IF(D348=\"Unknown\",100*G348,J348*G348))","v":0},{"$f":"IF(D348=\"Yes\",\"V\",IF(D348=\"Unknown\",\"??\",IF(D348=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
[3,"IT Security",null,null,null,null,null,{"$f":"(H357+H379+H402+H460+H480)","v":1},{"$f":"(I357+I379+I402+I460+I480)","v":1},null,{"$f":"(K357+K379+K402+K460+K480)","v":0},{"$f":"(L357+L379+L402+L460+L480)","v":0}]
["3.1","Segregation of data",null,null,1,{"$f":"(F358+F368)","v":1},{"$f":"(G358+G368)","v":1},0.25,{"$f":"IF(E357,H357*SUM($H$357,$H$379,$H$402,$H$460,$H$480,)/($E$357*$H$357+$E$379*$H$379+$E$402*$H$402+$E$460*$H$460+$E$480*$H$480),0)","v":0.25},null,{"$f":"(K358+K368)*I357/100","v":0},{"$f":"(L358+L368)*I357/100","v":0}]
["3.1.1","Can the cloud service be provided as private or community?",null,null,{"$f":"IF($D358=\"N/A\",0,1)","v":1},0.38,{"$f":"IF(E358,F358*SUM($F$358,$F$368,)/($E$358*$F$358+$E$368*$F$368),0)","v":0.38},null,null,{"$f":"IF(ISBLANK($D$358),0,VLOOKUP($D$358,$B$364:$C$366,2,0))","v":0},{"$f":"J358*G358","v":0},{"$f":"IF(ISBLANK(D358),0,IF(D358=\"Unknown\",100*G358,J358*G358))","v":0},null,{"$f":"IF(D358=\"Yes\",\"V\",IF(D358=\"Unknown\",\"??\",\"X\"))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"This might be useful when a separated instance for a governmental institution is needed."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[]
["3.1.2","In a multi-tenant system, are the data of the respective tenants segregated/isolated in such a way that it is technically impossible for any user of tenant A to receive entitlements to data of tenant B?",null,null,{"$f":"IF($D$368=\"N/A\",0,1)","v":1},0.62,{"$f":"IF(E368,F368*SUM($F$358,$F$368,)/($E$358*$F$358+$E$368*$F$368),0)","v":0.62},null,null,{"$f":"IF(ISBLANK($D$368),0,VLOOKUP($D$368,$B$374:$C$377,2,0))","v":0},{"$f":"J368*G368","v":0},{"$f":"IF(ISBLANK(D368),0,IF(D368=\"Unknown\",100*G368,J368*G368))","v":0},{"$f":"IF(D368=\"Yes\",\"V\",IF(D368=\"Unknown\",\"??\",IF(D368=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. VLAN isolation, data-at-rest encryption, user choice of the datacenter."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.2","Interface security",null,null,{"$f":"IF(AND($D$380=\"N/A\",$D$391=\"N/A\"),0,1)","v":1},{"$f":"(F380+F391)","v":1},{"$f":"(G380+G391)","v":1},0.12,{"$f":"IF(E379,H379*SUM($H$357,$H$379,$H$402,$H$460,$H$480,)/($E$357*$H$357+$E$379*$H$379+$E$402*$H$402+$E$460*$H$460+$E$480*$H$480),0)","v":0.12},null,{"$f":"(K380+K391)*I379/100","v":0},{"$f":"(L380+L391)*I379/100","v":0}]
["3.2.1","Are APIs developed in accordance with standards?",null,null,{"$f":"IF($D380=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E380,F380*SUM($F$380,$F$391,)/($E$380*$F$380+$E$391*$F$391),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$380),0,VLOOKUP($D$380,$B$386:$C$389,2,0))","v":0},{"$f":"J380*G380","v":0},{"$f":"IF(ISBLANK(D380),0,IF(D380=\"Unknown\",100*G380,J380*G380))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. following the OWASP guidelines."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.2.2","Are data integrity and security ensured for input and output?",null,null,{"$f":"IF($D391=\"N/A\",0,1)","v":1},0.6,{"$f":"IF(E391,F391*SUM($F$380,$F$391,)/($E$380*$F$380+$E$391*$F$391),0)","v":0.6},null,null,{"$f":"IF(ISBLANK($D$391),0,VLOOKUP($D$391,$B$397:$C$400,2,0))","v":0},{"$f":"J391*G391","v":0},{"$f":"IF(ISBLANK(D391),0,IF(D391=\"Unknown\",100*G391,J391*G391))","v":0},{"$f":"IF(D391=\"Yes\",\"V\",IF(D391=\"Unknown\",\"??\",IF(D391=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with HTTPS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3","Infrastructure and virtualization security",null,null,{"$f":"IF(AND($D$403=\"N/A\",$D$414=\"N/A\",$D$427=\"N/A\",$D$438=\"N/A\",$D$449=\"N/A\"),0,1)","v":1},{"$f":"(F403+F414+F427+F438+F449)","v":1},{"$f":"(G403+G414+G427+G438+G449)","v":1},0.22,{"$f":"IF(E402,H402*SUM($H$357,$H$379,$H$402,$H$460,$H$480,)/($E$357*$H$357+$E$379*$H$379+$E$402*$H$402+$E$460*$H$460+$E$480*$H$480),0)","v":0.22},null,{"$f":"(K403+K414+K427+K438+K449)*I402/100","v":0},{"$f":"(L403+L414+L427+L438+L449)*I402/100","v":0}]
["3.3.1","Is the access to hypervisors management functions and administration consoles highly controlled?",null,null,{"$f":"IF($D403=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E403,F403*SUM($F$403,$F$414,$F$427,$F$438,$F$449,)/($E$403*$F$403+$E$414*$F$414+$E$427*$F$427+$E$438*$F$438+$E$449*$F$449),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$403),0,VLOOKUP($D$403,$B$409:$C$412,2,0))","v":0},{"$f":"J403*G403","v":0},{"$f":"IF(ISBLANK(D403),0,IF(D403=\"Unknown\",100*G403,J403*G403))","v":0},{"$f":"IF(D403=\"Yes\",\"V\",IF(D403=\"Unknown\",\"??\",IF(D403=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with strong authentication, SSL/TLS communication."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.2","Is data securely deleted from all storage media when the user’s or tenant’s account is deleted?",null,null,{"$f":"IF($D414=\"N/A\",0,1)","v":1},0.17,{"$f":"IF(E414,F414*SUM($F$403,$F$414,$F$427,$F$438,$F$449,)/($E$403*$F$403+$E$414*$F$414+$E$427*$F$427+$E$438*$F$438+$E$449*$F$449),0)","v":0.17},null,null,{"$f":"IF(ISBLANK($D$414),0,VLOOKUP($D$414,$B$422:$C$425,2,0))","v":0},{"$f":"J414*G414","v":0},{"$f":"IF(ISBLANK(D414),0,IF(D414=\"Unknown\",100*G414,J414*G414))","v":0},{"$f":"IF(D414=\"Yes\",\"V\",IF(D414=\"Unknown\",\"??\",IF(D414=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The deletion must absolutely erase all copies of data, except meta-data that might be kept for judicial or accounting requirements."]
[null,"After deletion, the data should not be forensically recoverable."]
[null,"E.g. with cryptographic wiping, demagnetize data storage."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.3","Does the CSP take defense-in-depth approach to wired or wireless network security?",null,null,{"$f":"IF($D427=\"N/A\",0,1)","v":1},0.23,{"$f":"IF(E427,F427*SUM($F$403,$F$414,$F$427,$F$438,$F$449,)/($E$403*$F$403+$E$414*$F$414+$E$427*$F$427+$E$438*$F$438+$E$449*$F$449),0)","v":0.23},null,null,{"$f":"IF(ISBLANK($D$427),0,VLOOKUP($D$427,$B$433:$C$436,2,0))","v":0},{"$f":"J427*G427","v":0},{"$f":"IF(ISBLANK(D427),0,IF(D427=\"Unknown\",100*G427,J427*G427))","v":0},{"$f":"IF(D427=\"Yes\",\"V\",IF(D427=\"Unknown\",\"??\",IF(D427=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with firewalls, APT detection tools."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.4","Are sufficient controls in place at the hardware and virtual (if applicable) levels?",null,null,{"$f":"IF($D438=\"N/A\",0,1)","v":1},0.23,{"$f":"IF(E438,F438*SUM($F$403,$F$414,$F$427,$F$438,$F$449,)/($E$403*$F$403+$E$414*$F$414+$E$427*$F$427+$E$438*$F$438+$E$449*$F$449),0)","v":0.23},null,null,{"$f":"IF(ISBLANK($D$438),0,VLOOKUP($D$438,$B$444:$C$447,2,0))","v":0},{"$f":"J438*G438","v":0},{"$f":"IF(ISBLANK(D438),0,IF(D438=\"Unknown\",100*G438,J438*G438))","v":0},{"$f":"IF(D438=\"Yes\",\"V\",IF(D438=\"Unknown\",\"??\",IF(D438=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. only used ports opened, file integrity monitoring, logging, IDS/IPS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.5","Are security mechanisms to prevent and analyze data leakage at the hardware and virtual (if applicable) levels available?",null,null,{"$f":"IF($D449=\"N/A\",0,1)","v":1},0.23,{"$f":"IF(E449,F449*SUM($F$403,$F$414,$F$427,$F$438,$F$449,)/($E$403*$F$403+$E$414*$F$414+$E$427*$F$427+$E$438*$F$438+$E$449*$F$449),0)","v":0.23},null,null,{"$f":"IF(ISBLANK($D$449),0,VLOOKUP($D$449,$B$455:$C$458,2,0))","v":0},{"$f":"J449*G449","v":0},{"$f":"IF(ISBLANK(D449),0,IF(D449=\"Unknown\",100*G449,J449*G449))","v":0},{"$f":"IF(D449=\"Yes\",\"V\",IF(D449=\"Unknown\",\"??\",IF(D449=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with DLP."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4","OS security (only for SaaS and PaaS cloud services)",null,null,{"$f":"IF(OR(Information!C5=\"IaaS\",AND($D$461=\"N/A\",$D$472=\"N/A\")),0,1)","v":1},{"$f":"(F461+F472)","v":1},{"$f":"(G461+G472)","v":1},0.25,{"$f":"IF(E460,H460*SUM($H$357,$H$379,$H$402,$H$460,$H$480,)/($E$357*$H$357+$E$379*$H$379+$E$402*$H$402+$E$460*$H$460+$E$480*$H$480),0)","v":0.25},null,{"$f":"(K461+K472)*I460/100","v":0},{"$f":"(L461+L472)*I460/100","v":0}]
["3.4.1","Are tools to prevent, detect and mitigate viruses and malwares at server stations available?",null,null,{"$f":"IF($D$461=\"N/A\",0,1)","v":1},0.6,{"$f":"IF(E461,F461*SUM($F$461,$F$472,)/($E$461*$F$461+$E$472*$F$472),0)","v":0.6},null,null,{"$f":"IF(ISBLANK($D$461),0,VLOOKUP($D$461,$B$467:$C$470,2,0))","v":0},{"$f":"J461*G461","v":0},{"$f":"IF(ISBLANK(D461),0,IF(D461=\"Unknown\",100*G461,J461*G461))","v":0},{"$f":"IF(D461=\"Yes\",\"V\",IF(D461=\"N/A\",\"N/A\",IF(D461=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question depends on the cloud service model: N/A for IaaS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.2","Is hardening process performed on the server stations?",null,null,{"$f":"IF($D$472=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E472,F472*SUM($F$461,$F$472,)/($E$461*$F$461+$E$472*$F$472),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$472),0,VLOOKUP($D$472,$B$475:$C$478,2,0))","v":0},{"$f":"J472*G472","v":0},{"$f":"IF(ISBLANK(D472),0,IF(D472=\"Unknown\",100*G472,J472*G472))","v":0},{"$f":"IF(D472=\"Yes\",\"V\",IF(D472=\"N/A\",\"N/A\",IF(D472=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5","Cryptography for the protection of the tenant's data",null,null,{"$f":"IF(AND($D$481=\"N/A\",$D$492=\"N/A\",$D$500=\"N/A\",$D$511=\"N/A\",$D$519=\"N/A\",$D$530=\"N/A\",$D$541=\"N/A\"),0,1)","v":1},{"$f":"(F481+F492+F500+F511+F519+F530+F541)","v":1},{"$f":"(G481+G492+G500+G511+G519+G530+G541)","v":1},0.16,{"$f":"IF(E480,H480*SUM($H$357,$H$379,$H$402,$H$460,$H$480,)/($E$357*$H$357+$E$379*$H$379+$E$402*$H$402+$E$460*$H$460+$E$480*$H$480),0)","v":0.16},null,{"$f":"(K481+K492+K500+K511+K519+K530+K541)*I480/100","v":0},{"$f":"(L481+L492+L500+L511+L519+L530+L541)*I480/100","v":0}]
["3.5.1","Who is in charge of the key management?",null,null,{"$f":"IF($D481=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E481,F481*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$481),0,VLOOKUP($D$481,$B$484:$C$490,2,0))","v":0},{"$f":"J481*G481","v":0},{"$f":"IF(ISBLANK(D481),0,IF(D481=\"Unknown\",100*G481,J481*G481))","v":0},null,{"$f":"IF(OR(D481=\"Tenant user\",D481=\"Tenant system administrator\"),\"V\",IF(D481=\"Unknown\",\"??\",IF(D481=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Tenant user",30]
[null,"Tenant system administrator",100]
[null,"CSP",15]
[null,"Subcontractor",5]
[null,"Trusted third party (e.g. key management provider)",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5.2","Has the key management been defined through policies and procedures as required by the ISO/IEC27002:2013 standard?",null,null,{"$f":"IF($D492=\"N/A\",0,1)","v":1},0.13,{"$f":"IF(E492,F492*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.13},null,null,{"$f":"IF(ISBLANK($D$492),0,VLOOKUP($D$492,$B$495:$C$498,2,0))","v":0},{"$f":"J492*G492","v":0},{"$f":"IF(ISBLANK(D492),0,IF(D492=\"Unknown\",100*G492,J492*G492))","v":0}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5.3","Have the cryptographic mechanisms used for the cloud service been defined to guarantee adequate cryptographic strength?",null,null,{"$f":"IF($D500=\"N/A\",0,1)","v":1},0.13,{"$f":"IF(E500,F500*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.13},null,null,{"$f":"IF(ISBLANK($D$500),0,VLOOKUP($D$500,$B$506:$C$509,2,0))","v":0},{"$f":"J500*G500","v":0},{"$f":"IF(ISBLANK(D500),0,IF(D500=\"Unknown\",100*G500,J500*G500))","v":0}]
[]
[null,"Explanations / Examples"]
[null,"E.g. following the NIST standards of algorithms and key length."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5.4","Does the CSP use HSMs (Hardware Security Modules) for the protection of keys?",null,null,{"$f":"IF($D511=\"N/A\",0,1)","v":1},0.13,{"$f":"IF(E511,F511*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.13},null,null,{"$f":"IF(ISBLANK($D$511),0,VLOOKUP($D$511,$B$514:$C$517,2,0))","v":0},{"$f":"J511*G511","v":0},{"$f":"IF(ISBLANK(D511),0,IF(D511=\"Unknown\",100*G511,J511*G511))","v":0}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5.5","Is client-side encryption of data possible?",null,null,{"$f":"IF($D519=\"N/A\",0,1)","v":1},0.05,{"$f":"IF(E519,F519*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.05},null,null,{"$f":"IF(ISBLANK($D$519),0,VLOOKUP($D$519,$B$525:$C$528,2,0))","v":0},{"$f":"J519*G519","v":0},{"$f":"IF(ISBLANK(D519),0,IF(D519=\"Unknown\",100*G519,J519*G519))","v":0},null,{"$f":"IF(D519=\"Yes\",\"V\",IF(D519=\"Unknown\",\"??\",IF(D519=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"This may prevent the CSP and potential subcontractors from obtaining the data in clear if they do not manage the keys."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5.6","Is data-at-rest confidentiality ensured?",null,null,{"$f":"IF($D530=\"N/A\",0,1)","v":1},0.19,{"$f":"IF(E530,F530*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.19},null,null,{"$f":"IF(ISBLANK($D$530),0,VLOOKUP($D$530,$B$536:$C$539,2,0))","v":0},{"$f":"J530*G530","v":0},{"$f":"IF(ISBLANK(D530),0,IF(D530=\"Unknown\",100*G530,J530*G530))","v":0},null,{"$f":"IF(D530=\"Yes\",\"V\",IF(D530=\"Unknown\",\"??\",IF(D530=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with encryption."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.5.7","Is data-at-rest integrity ensured?",null,null,{"$f":"IF($D541=\"N/A\",0,1)","v":1},0.19,{"$f":"IF(E541,F541*SUM($F$481,$F$492,$F$500,$F$511,$F$519,$F$530,$F$541,)/($E$481*$F$481+$E$492*$F$492+$E$500*$F$500+$E$511*$F$511+$E$519*$F$519+$E$530*$F$530+$E$541*$F$541),0)","v":0.19},null,null,{"$f":"IF(ISBLANK($D$541),0,VLOOKUP($D$541,$B$547:$C$550,2,0))","v":0},{"$f":"J541*G541","v":0},{"$f":"IF(ISBLANK(D541),0,IF(D541=\"Unknown\",100*G541,J541*G541))","v":0},{"$f":"IF(D541=\"Yes\",\"V\",IF(D541=\"Unknown\",\"??\",IF(D541=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with digital signature or hashing."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
[4,"Operational Security",null,null,null,null,null,{"$f":"(H553+H606+H634)","v":1},{"$f":"(I553+I606+I634)","v":1},null,{"$f":"(K553+K606+K634)","v":0},{"$f":"(L553+L606+L634)","v":0}]
["4.1","Backup and disaster recovery",null,null,{"$f":"IF(AND($D$554=\"N/A\",$D$562=\"N/A\",$D$570=\"N/A\",$D$584=\"N/A\",$D$597=\"N/A\"),0,1)","v":1},{"$f":"(F554+F562+F570+F584+F597)","v":1},{"$f":"(G554+G562+G570+G584+G597)","v":1},0.34,{"$f":"IF(E553,H553*SUM($H$553,$H$606,$H$634)/($E$553*$H$553+$E$606*$H$606+$E$634*$H$634),0)","v":0.34},null,{"$f":"(K554+K562+K570+K584+K597)*I553/100","v":0},{"$f":"(L554+L562+L570+L584+L597)*I553/100","v":0}]
["4.1.1","Can the backup retention plan be defined by the tenant?",null,null,{"$f":"IF($D554=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E554,F554*SUM($F$554,$F$562,$F$570,$F$584,$F$597,)/($E$554*$F$554+E$562*$F$562+$E$570*$F$570+$E$584*$F$584+$E$597*$F$597),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$554),0,VLOOKUP($D$554,$B$557:$C$560,2,0))","v":0},{"$f":"J554*G554","v":0},{"$f":"IF(ISBLANK(D554),0,IF(D554=\"Unknown\",100*G554,J554*G554))","v":0},{"$f":"IF(D554=\"Yes\",\"V\",IF(D554=\"Unknown\",\"??\",IF(D554=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.2","Are backup controls defined and adequate?",null,null,{"$f":"IF($D562=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E562,F562*SUM($F$554,$F$562,$F$570,$F$584,$F$597,)/($E$554*$F$554+E$562*$F$562+$E$570*$F$570+$E$584*$F$584+$E$597*$F$597),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$562),0,VLOOKUP($D$562,$B$565:$C$568,2,0))","v":0},{"$f":"J562*G562","v":0},{"$f":"IF(ISBLANK(D562),0,IF(D562=\"Unknown\",100*G562,J562*G562))","v":0},{"$f":"IF(D562=\"Yes\",\"V\",IF(D562=\"Unknown\",\"??\",IF(D562=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.3","Which RTO (Recovery Time objective) can be satisfied by the cloud service?",null,null,{"$f":"IF($D570=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E570,F570*SUM($F$554,$F$562,$F$570,$F$584,$F$597,)/($E$554*$F$554+E$562*$F$562+$E$570*$F$570+$E$584*$F$584+$E$597*$F$597),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$570),0,VLOOKUP($D$570,$B$576:$C$582,2,0))","v":0},{"$f":"J570*G570","v":0},{"$f":"IF(ISBLANK(D570),0,IF(D570=\"Unknown\",100*G570,J570*G570))","v":0},{"$f":"IF(OR(D570=\"< 1 week\",D570=\"No RTO\",D570=\"\"),\"X\",IF(D570=\"Unknown\",\"??\",IF(D570=\"N/A\",\"N/A\",\"V\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"This is the time within which the cloud service must be restored after a disaster."]
[]
[null,"Score specification"]
[null,"No RTO",0]
[null,"< 1 hour",100]
[null,"< 4 hours",80]
[null,"< 1 day",60]
[null,"< 1 week",10]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.4","Which RPO (Recovery Point objective) can be satisfied by the cloud service?",null,null,{"$f":"IF($D584=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E584,F584*SUM($F$554,$F$562,$F$570,$F$584,$F$597,)/($E$554*$F$554+E$562*$F$562+$E$570*$F$570+$E$584*$F$584+$E$597*$F$597),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$584),0,VLOOKUP($D$584,$B$590:$C$595,2,0))","v":0},{"$f":"J584*G584","v":0},{"$f":"IF(ISBLANK(D584),0,IF(D584=\"Unknown\",100*G584,J584*G584))","v":0},{"$f":"IF(OR(D584=\"1 week\",D584=\"No RPO\",D584=\"\"),\"X\",IF(D584=\"Unknown\",\"??\",IF(D584=\"N/A\",\"N/A\",\"V\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"This is the maximum period in which data might be lost by the cloud service due to a disaster."]
[]
[null,"Score specification"]
[null,"No RPO",0]
[null,"1 hour",100]
[null,"1 day",70]
[null,"1 week",10]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.5","Are tenants able to perform recovery tests, including reporting?",null,null,{"$f":"IF($D597=\"N/A\",0,1)","v":1},0.1,{"$f":"IF(E597,F597*SUM($F$554,$F$562,$F$570,$F$584,$F$597,)/($E$554*$F$554+E$562*$F$562+$E$570*$F$570+$E$584*$F$584+$E$597*$F$597),0)","v":0.1},null,null,{"$f":"IF(ISBLANK($D$597),0,VLOOKUP($D$597,$B$600:$C$604,2,0))","v":0},{"$f":"J597*G597","v":0},{"$f":"IF(ISBLANK(D597),0,IF(D597=\"Unknown\",100*G597,J597*G597))","v":0},{"$f":"IF(OR(D597=\"No\",D597=\"\"),\"X\",IF(D597=\"Unknown\",\"??\",IF(D597=\"N/A\",\"N/A\",\"V\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes, regularly",100]
[null,"Yes, once",70]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.2","Incident management",null,null,{"$f":"IF(AND($D$607=\"N/A\",$D$615=\"N/A\",$D$623=\"N/A\"),0,1)","v":1},{"$f":"(F607+F615+F623)","v":1},{"$f":"(G607+G615+G623)","v":1},0.33,{"$f":"IF(E606,H606*SUM($H$553,$H$606,$H$634)/($E$553*$H$553+$E$606*$H$606+$E$634*$H$634),0)","v":0.33},null,{"$f":"(K607+K615+K623)*I606/100","v":0},{"$f":"(L607+L615+L623)*I606/100","v":0}]
["4.2.1","Does the CSP have a SIEM (Security Information and Event Management) for analyzing the security alerts and data logs?",null,null,{"$f":"IF($D607=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E607,F607*SUM($F$607,$F$615,$F$623,)/($E$607*$F$607+$E$615*$F$615+$E$623*$F$623),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$607),0,VLOOKUP($D$607,$B$610:$C$613,2,0))","v":0},{"$f":"J607*G607","v":0},{"$f":"IF(ISBLANK(D607),0,IF(D607=\"Unknown\",100*G607,J607*G607))","v":0},{"$f":"IF(D607=\"Yes\",\"V\",IF(D607=\"Unknown\",\"??\",IF(D607=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.2.2","Does the CSP have an adequate incident management procedure for managing and minimizing the impact of security incidents on tenants’ data?",null,null,{"$f":"IF($D615=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E615,F615*SUM($F$607,$F$615,$F$623,)/($E$607*$F$607+$E$615*$F$615+$E$623*$F$623),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$615),0,VLOOKUP($D$615,$B$618:$C$621,2,0))","v":0},{"$f":"J615*G615","v":0},{"$f":"IF(ISBLANK(D615),0,IF(D615=\"Unknown\",100*G615,J615*G615))","v":0},{"$f":"IF(D615=\"Yes\",\"V\",IF(D615=\"Unknown\",\"??\",IF(D615=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.2.3","Does the CSP have adequate security policies and procedures regarding CSP employee security?",null,null,{"$f":"IF($D623=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E623,F623*SUM($F$607,$F$615,$F$623,)/($E$607*$F$607+$E$615*$F$615+$E$623*$F$623),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$623),0,VLOOKUP($D$623,$B$629:$C$632,2,0))","v":0},{"$f":"J623*G623","v":0},{"$f":"IF(ISBLANK(D623),0,IF(D623=\"Unknown\",100*G623,J623*G623))","v":0},{"$f":"IF(D623=\"Yes\",\"V\",IF(D623=\"Unknown\",\"??\",IF(D623=\"N/A\",\"N/A\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"E.g. acceptable user policy, security awareness program, disciplinary process."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.3","Vulnerability management (only for SaaS and PaaS cloud services)",null,null,{"$f":"IF(OR(Information!C5=\"IaaS\",AND($D$635=\"N/A\",$D$646=\"N/A\")),0,1)","v":1},{"$f":"(F635+F646)","v":1},{"$f":"(G635+G646)","v":1},0.33,{"$f":"IF(E634,H634*SUM($H$553,$H$606,$H$634)/($E$553*$H$553+$E$606*$H$606+$E$634*$H$634),0)","v":0.33},null,{"$f":"(K635+K646)*I634/100","v":0},{"$f":"(L635+L646)*I634/100","v":0}]
["4.3.1","Is there a documented patch management process implemented in the cloud service?",null,null,{"$f":"IF($D635=\"N/A\",0,1)","v":1},0.5,{"$f":"IF(E635,F635*SUM($F$635,$F$646,)/($E$635*$F$635+$E$646*$F$646),0)","v":0.5},null,null,{"$f":"IF(ISBLANK($D$635),0,VLOOKUP($D$635,$B$641:$C$644,2,0))","v":0},{"$f":"J635*G635","v":0},{"$f":"IF(ISBLANK(D635),0,IF(D635=\"Unknown\",100*G635,J635*G635))","v":0},{"$f":"IF(D635=\"Yes\",\"V\",IF(D635=\"N/A\",\"N/A\",IF(D635=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question depends on the cloud service model: N/A for IaaS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.3.2","Does the CSP test patches in acceptance environments prior to deployment?",null,null,{"$f":"IF($D$646=\"N/A\",0,1)","v":1},0.5,{"$f":"IF(E646,F646*SUM($F$635,$F$646,)/($E$635*$F$635+$E$646*$F$646),0)","v":0.5},null,null,{"$f":"IF(ISBLANK($D$646),0,VLOOKUP($D$646,$B$652:$C$655,2,0))","v":0},{"$f":"J646*G646","v":0},{"$f":"IF(ISBLANK(D646),0,IF(D646=\"Unknown\",100*G646,J646*G646))","v":0},{"$f":"IF(D646=\"Yes\",\"V\",IF(D646=\"N/A\",\"N/A\",IF(D646=\"Unknown\",\"??\",\"X\")))","v":"X"}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question depends on the cloud service model: N/A for IaaS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]

{"sheet":"Conditional answers","index":3,"n_rows":7,"n_cols":14,"rows_kept":7,"cut":false,"hidden":true,"merged":[]}
["Service model","Answer121","Answer131",null,null,"If Answer=Unknown","If Answer=No","If Anwser=Never","If Answer=Yes and expect a Yes/No answer","If Answer=time interval","If ServiceModel=SaaS","If ServiceModel=PaaS","If ServiceModel=IaaS","Chart options"]
["SaaS","Yes","≤ 6 months",null,null,"Unknown","N/A","N/A","Yes","Yes","Yes","Yes","N/A","Cloud service DOES satisfy"]
["PaaS","No","1 year",null,null,null,null,null,"No","No","No","No",null,"Cloud service MAY satisfy"]
["IaaS","Unknown","2 years",null,null,null,null,null,"Unknown","Unknown","Unknown","Unknown",null,"Cloud service DOES NOT satisfy"]
[null,null,"> 2 years",null,null,null,null,null,null,null,"N/A","N/A"]
[null,null,"Never"]
[null,null,"Unknown"]

{"sheet":"Overview","index":4,"n_rows":8,"n_cols":13,"rows_kept":8,"cut":false,"hidden":false,"merged":[[2,7,2,9],[2,10,2,12],[0,1,0,12]]}
[null,{"$f":"CONCATENATE(\"Score overview of \",Information!C3)","v":"Score overview of <name>"}]
[]
[null,null,null,null,null,null,null,"Compliance with cloud policy  (ignoring the data type)",null,null,"Compliance with cloud policy     (if personal/social/medical data)"]
[null,null,"Minimal weighted score","Maximal weighted score",null,null,null,"Does comply","May comply","Does not comply","Does comply","May comply","Does not comply"]
[1,"Governance",{"$f":"Assessment!K5","v":0},{"$f":"Assessment!L5","v":0},null,null,"Governance",{"$f":"COUNTIF(Assessment!$M$5:$M$220,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$220,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$220,\"X\")","v":14},{"$f":"H5","v":0},0,14]
[1,"IAM",{"$f":"Assessment!K221","v":0},{"$f":"Assessment!L221","v":0},null,null,"IAM",{"$f":"COUNTIF(Assessment!$M$221:$M$355,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$221:$M$355,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$221:$M$355,\"X\")","v":4},0,0,4]
[1,"IT Security",{"$f":"Assessment!K356","v":0},{"$f":"Assessment!L356","v":0},null,null,"IT Security",{"$f":"COUNTIF(Assessment!$M$356:$M$551,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$356:$M$551,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$356:$M$551,\"X\")","v":10},{"$f":"COUNTIF(Assessment!$N$356:$N$551,\"V\")+H7","v":0},{"$f":"COUNTIF(Assessment!$N$356:$N$551,\"??\")+I7","v":0},{"$f":"COUNTIF(Assessment!$N$356:$N$551,\"X\")+J7","v":14}]
[1,"Operational Security",{"$f":"Assessment!K552","v":0},{"$f":"Assessment!L552","v":0},null,null,"Operational Security",{"$f":"COUNTIF(Assessment!$M$552:$M$656,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$552:$M$656,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$552:$M$656,\"X\")","v":10},{"$f":"H8","v":0},{"$f":"I8","v":0},{"$f":"J8","v":10}]

{"sheet":"TempResults","index":5,"n_rows":6,"n_cols":10,"rows_kept":6,"cut":false,"hidden":true,"merged":[[0,3,0,5],[0,6,0,8]]}
[null,null,null,"Compliance with cloud policy (not depending on data type)",null,null,"Compliance with cloud policy (depending on data type)"]
[null,"Minimal weighted score","Maximal weighted score","Does comply","May comply","Does not comply","Does comply","May comply","Does not comply","Name of the cloud service"]
["Governance",{"$f":"Assessment!K5","v":0},{"$f":"Assessment!L5","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$220,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$220,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$220,\"X\")","v":14},{"$f":"D3","v":0},0,14,{"$f":"Information!C3","v":"<name>"}]
["IAM",{"$f":"Assessment!K221","v":0},{"$f":"Assessment!L221","v":0},{"$f":"COUNTIF(Assessment!$M$221:$M$355,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$221:$M$355,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$221:$M$355,\"X\")","v":4},0,0,4]
["IT Security",{"$f":"Assessment!K356","v":0},{"$f":"Assessment!L356","v":0},{"$f":"COUNTIF(Assessment!$M$356:$M$551,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$356:$M$551,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$356:$M$551,\"X\")","v":10},{"$f":"COUNTIF(Assessment!$N$356:$N$551,\"V\")+D5","v":0},{"$f":"COUNTIF(Assessment!$N$356:$N$551,\"??\")+E5","v":0},{"$f":"COUNTIF(Assessment!$N$356:$N$551,\"X\")+F5","v":14}]
["Operational Security",{"$f":"Assessment!K552","v":0},{"$f":"Assessment!L552","v":0},{"$f":"COUNTIF(Assessment!$M$552:$M$656,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$552:$M$656,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$552:$M$656,\"X\")","v":10},{"$f":"D6","v":0},{"$f":"E6","v":0},{"$f":"F6","v":10}]