{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["Intro","Information","Conditional answers","Assessment","Overview","TempResults"],"not_rendered":{"charts":6,"images":1,"macros":1,"external_links":1,"defined_names":20,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Intro","index":0,"n_rows":39,"n_cols":3,"rows_kept":39,"cut":false,"hidden":false,"merged":[[18,1,18,7],[19,1,19,7],[27,0,30,0],[23,1,23,7],[33,0,35,0],[36,1,36,7],[37,1,37,7],[24,1,24,7],[26,1,26,7],[27,1,27,7],[34,1,34,7],[35,1,35,7],[29,1,29,7],[25,1,25,7],[33,1,33,7],[32,1,32,7],[38,1,38,7],[28,1,28,7],[31,1,31,7],[30,1,30,7],[3,1,3,7],[6,1,6,7],[7,0,7,1],[22,1,22,7],[8,2,8,7],[9,2,9,7],[10,2,10,7],[11,2,11,7],[12,2,12,7],[13,2,13,7],[14,2,14,7],[15,2,15,7]]}
[]
["Smals Cloud Service Security Assessment Model"]
["VERSION:","3.0"]
["LICENSE:","Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License "]
[null,"http://creativecommons.org/licenses/by-nc-sa/4.0/"]
[]
[]
["Change tracking"]
["1.0","2014-11-28","First release"]
["2.0","2014-12-16","The ponderations are now locked"]
["2.1","2015-06-08","Some visual and security enhancements have been added"]
["2.2","2016-02-08","Correction of a ponderation"]
["2.3","2016-02-16","Correction related to the compliance with the cloud policy"]
["2.4","2016-04-19","Some visual and security enhancements have been added"]
["2.5","2017-06-28","Some modifications in the questions have been added"]
["3.0","2020-11-27","Revision of the questions and a clearer definition of the applicability of this model"]
[]
["Interpretation of results"]
[null,"Be careful with the interpretation of the scores. This evaluation form is indicative, and only a human judge should decide whether of not the evaluation is sufficiently accurate. The human judge should contact the CSP of the cloud service if (s)he needs additional information."]
[null,"This model and its questions aim to stimulatie critical reflection about the security and privacy risks of the provided service."]
[]
["How to use this template:"]
["1.","The goal of this evaluation form is allowing an entity  (called the assessor) to assess the security level of a cloud service offered by a Cloud Service Provider (CSP) in 4 dimensions:\n- Governance\n- Identity and Access Management (IAM)\n- IT Security\n- Operational Security"]
["2.","Before completing the evaluation form, the assessor should be in the possession of all the publicly available information published on the official website of the cloud service, in particular a standard contract and all the available datasheets. We assume that the information found on the official website is correct."]
["3.","The \"Information\" tab should be completed with general info related to the assessment: cloud service name/provider/model, the name of the assessor, and the date of the assessment."]
["4.","The \"Assessment\" tab contains all the questions necessary for the evaluation of a cloud service."]
["4.1.","The column \"answer's value\" contains the relative score of each expected response for each question (over 100) as a reference. The cells containing the relative scores must not be changed."]
["4.2.","The column \"score\" has to be filled using the possible answers. "]
[null,"Note: The questions must be filled according to the given order, as some questions depend on the answers given in previous questions."]
[null,"Note: If a score is not applicable, the option \"N/A\" must be chosen. This redistribute its weights over the other sub questions."]
[null,"Note: If the assessor does not know the answer to a question, the option \"Unknown\" must be chosen. This will give two different scores for one topic."]
["4.3.","Each question has been defined with a specific weight. From the scores of each question, the final weighted scores are automatically filled (in combination with the defined weights)."]
["4.4.","There are 2 different results: the minimal weighted score and the maximal weighted score.\n- The minimal weighted score corresponds to the situation where all the \"Unknown\" responses have been replaced by the worst answer. This is the worst case of the security evaluation, considering the uncertainty of the \"Unknown\" responses.\n- The maximal weighted score corresponds to the situation where all the \"Unknown\" responses have been replaced by the best answer. This is the best case of the security evaluation, considering the uncertainty of the \"Unknown\" responses."]
["4.5.","The two last columns grouped under \"compliance with cloud policy\" refer to the guarantees required by the cloud policy of the Social Security."]
[null,"The column \"ignoring the data type\" refers to the cloud policy guarantees that do not depend on the type of data to be stored in the cloud service."]
[null,"The column \"if personal, social or medical data\" refers to the additional cloud policy guarantees expected when the data to be stored in the cloud service are personal, social or medical."]
["5.","The \"Overview\" tab is a visual aide for the assessor."]
["5.1.","The chart represents the minimal and maximal weighted scores of each dimension."]
["5.2.","The donuts represent the compliance to the cloud policy per criterion when the data type is ignored."]

{"sheet":"Information","index":1,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[0,1,0,2]]}
[null,"Cloud service informations"]
[]
[null,"Cloud service name:"]
[null,"Cloud service provider (CSP):"]
[null,"Evaluated by:"]
[null,"Evaluated date:"]

{"sheet":"Conditional answers","index":2,"n_rows":7,"n_cols":14,"rows_kept":7,"cut":false,"hidden":true,"merged":[]}
["Service model","Answer121","Answer131",null,null,"If Answer=Unknown","If Answer=No","If Anwser=Never","If Answer=Yes and expect a Yes/No answer","If Answer=time interval","If ServiceModel=SaaS","If ServiceModel=PaaS","If ServiceModel=IaaS","Chart options"]
["SaaS","Yes","≤ 6 months",null,null,"Unknown","N/A","N/A","Yes","Yes","Yes","Yes","N/A","Cloud service DOES satisfy"]
["PaaS","No","1 year",null,null,null,null,null,"No","No","No","No",null,"Cloud service MAY satisfy"]
["IaaS","Unknown","2 years",null,null,null,null,null,"Unknown","Unknown","Unknown","Unknown",null,"Cloud service DOES NOT satisfy"]
[null,null,"> 2 years",null,null,null,null,null,null,null,"N/A","N/A"]
[null,null,"Never"]
[null,null,"Unknown"]

{"sheet":"Assessment","index":3,"n_rows":640,"n_cols":13,"rows_kept":640,"cut":false,"hidden":false,"merged":[[0,1,0,12]]}
[null,{"$f":"CONCATENATE(\"Assessment of \",Information!C3)","v":"Assessment of "}]
[]
[null,"Category Title","Answer's value","Score","N/A?","Weight","Weight","Weight","Weight","Measured score","Minimal weighted score","Maximal weighted score","Cloud policy compliancy outlook"]
[null,"For more information open the outline (+ / - ) left from row number","Possibility to put some description in the question's rows","Select appropriate range or value for every question (select N/A if not applicable)",null,"Fixed values per subsection","Dynamic values per subsection from N/A","Fixed values per section","Dynamic values per section from N/A",null,"Values computed automated","Values computed automated","Ignoring the data type"]
[1,"Governance",null,null,null,null,null,{"$f":"(H6+H56+H84+H143+H177+H202)","v":0.99999999999999989},{"$f":"(I6+I56+I84+I143+I177+I202)","v":0.99999999999999989},null,{"$f":"(K6+K56+K84+K143+K177+K202)","v":0},{"$f":"(L6+L56+L84+L143+L177+L202)","v":0}]
["1.1","Legal implication",null,null,{"$f":"IF(AND($D$7=\"N/A\",$D$15=\"N/A\",$D$25=\"N/A\",$D$36=\"N/A\",$D$47=\"N/A\"),0,1)","v":1},{"$f":"(F7+F15+F25+F36+F47)","v":1},{"$f":"(G7+G15+G25+G36+G47)","v":1},0.18,{"$f":"IF(E6,H6*SUM($H$6,$H$56,$H$84,$H$143,$H$177,$H$202,)/($E$6*$H$6+$E$56*$H$56+$E$84*$H$84+$E$143*$H$143+$E$177*$H$177+$E$202*$H$202),0)","v":0.18},null,{"$f":"(K7+K15+K25+K36+K47)*I6/100","v":0},{"$f":"(L7+L15+L25+L36+L47)*I6/100","v":0}]
["1.1.1","What is the physical location of data (at-rest and for processing)?",null,null,{"$f":"IF($D7=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E7,F7*SUM($F$7,$F$15,$F$25,$F$36,$F$47)/($E$7*$F$7+$E$15*$F$15+$E$25*$F$25+$E$36*$F$36+$E$47*$F$47),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$7),0,VLOOKUP($D$7,$B$10:$C$13,2,0))","v":0},{"$f":"J7*G7","v":0},{"$f":"IF(ISBLANK(D7),0,IF(D7=\"Unknown\",100*G7,J7*G7))","v":0},{"$f":"IF(D7=\"\",\" \",IF(D7=B13,\"X\",\"V\"))","v":" "}]
[null,null,null,null,{"$f":"IF($D8=\"N/A\",0,1)","v":1}]
[null,"Score specification",null,null,1]
[null,"The country of the assessor",100,null,1]
[null,"EU",75,null,1]
[null,"Other",25,null,1]
[null,"Unknown",0,null,1]
[null,null,null,null,1]
["1.1.2","To which jurisdiction is the service of and the contract with the CSP conform? ",null,null,1,0.2,{"$f":"IF(E15,F15*SUM($F$7,$F$15,$F$25,$F$36,$F$47)/($E$7*$F$7+$E$15*$F$15+$E$25*$F$25+$E$36*$F$36+$E$47*$F$47),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$15),0,VLOOKUP($D$15,$B$18:$C$23,2,0))","v":0},{"$f":"J15*G15","v":0},{"$f":"IF(ISBLANK(D15),0,IF(D15=\"Unknown\",100*G15,J15*G15))","v":0},{"$f":"IF(D15=B22,\"X\",IF(D15=B18,\"V\",IF(D15=B19,\"V\",IF(D15=B23,\"??\",IF(D15=B20,\"V\", IF(D15=B21,\"X\",\" \"))))))","v":" "}]
[null,null,null,null,1]
[null,"Score specification",null,null,1]
[null,"The country of the assessor",100,null,1]
[null,"EU legislation",75,null,1]
[null,"A country with a legal framework that guarantees data protection compliant with EU legislation",75,null,1]
[null,"Substatantial data protection guaranteed by legislation and in contract, but not completely compliant with EU legislation",50]
[null,"Only weak or no data protection guaranteed by legislation and in contract",25,null,1]
[null,"Unknown",0,null,1]
[null,null,null,null,1]
["1.1.3","Can the CSP accomodate with the tenant's data retention requirements?",null,null,1,0.2,{"$f":"IF(E25,F25*SUM($F$7,$F$15,$F$25,$F$36,$F$47,)/($E$7*$F$7+$E$15*$F$15+$E$25*$F$25+$E$36*$F$36+$E$47*$F$47),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$25),0,VLOOKUP($D$25,$B$31:$C$34,2,0))","v":0},{"$f":"J25*G25","v":0},{"$f":"IF(ISBLANK(D25),0,IF(D25=\"Unknown\",100*G25,J25*G25))","v":0},{"$f":"IF(D25=B32,\"X\",IF(D25=B31,\"V\",IF(D25=B34,\"N/A\",IF(D25=B33,\"??\", \" \"))))","v":" "}]
[null,null,null,null,1]
[null,"Explanations / Examples",null,null,1]
[null,"E.g. either do not store data more than a few months, or store data for several years.",null,null,1]
[null,null,null,null,1]
[null,"Score specification",null,null,1]
[null,"Yes",100,null,1]
[null,"No",0,null,1]
[null,"Unknown",0,null,1]
[null,"N/A",-1,null,1]
[null,null,null,null,1]
["1.1.4","Can the data be given to governments outside the jurisdiction of the data controller, if requested for judicial requirements without informing the tenant or without constitutional guarantees?",null,null,1,0.2,{"$f":"IF(E36,F36*SUM($F$7,$F$15,$F$25,$F$36,$F$47)/($E$7*$F$7+$E$15*$F$15+$E$25*$F$25+$E$36*$F$36+$E$47*$F$47),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$36),0,VLOOKUP($D$36,$B$42:$C$45,2,0))","v":0},{"$f":"J36*G36","v":0},{"$f":"IF(ISBLANK(D36),0,IF(D36=\"Unknown\",100*G36,J36*G36))","v":0},{"$f":"IF(D36=B42,\"X\",IF(D36=B43,\"V\",IF(D36=B45,\"N/A\",IF(D36=B44,\"??\", \" \"))))","v":" "}]
[null,null,null,null,1]
[null,"Explanations / Examples",null,null,1]
[null,"The jurisdiction of the CSP should be taken into account.",null,null,1]
[null,null,null,null,1]
[null,"Score specification",null,null,1]
[null,"Yes",0,null,1]
[null,"No",100,null,1]
[null,"Unknown",0,null,1]
[null,"N/A",-1,null,1]
[null,null,null,null,1]
["1.1.5","Can the data be given to, shared with third parties, or used by the CSP for other purposes than the cloud service without the tenant’s consent?",null,null,1,0.2,{"$f":"IF(E47,F47*SUM($F$7,$F$15,$F$25,$F$36,$F$47)/($E$7*$F$7+$E$15*$F$15+$E$25*$F$25+$E$36*$F$36+$E$47*$F$47),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$47),0,VLOOKUP($D$47,$B$50:$C$53,2,0))","v":0},{"$f":"J47*G47","v":0},{"$f":"IF(ISBLANK(D47),0,IF(D47=\"Unknown\",100*G47,J47*G47))","v":0},{"$f":"IF(D47=B50,\"X\",IF(D47=B51,\"V\",IF(D47=B53,\"N/A\",IF(D47=B52,\"??\", \" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",0]
[null,"No",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
[]
["1.2","Supply chain management",null,null,{"$f":"IF(AND($D$57=\"N/A\",$D$65=\"N/A\",$D$76=\"N/A\"),0,1)","v":1},{"$f":"(F57+F65+F76)","v":0.99999999999999967},{"$f":"(G57+G65+G76)","v":0.99999999999999967},0.18,{"$f":"IF(E56,H56*SUM($H$6,$H$56,$H$84,$H$143,$H$177,$H$202,)/($E$6*$H$6+$E$56*$H$56+$E$84*$H$84+$E$143*$H$143+$E$177*$H$177+$E$202*$H$202),0)","v":0.18},null,{"$f":"(K57+K65+K76)*I56/100","v":0},{"$f":"(L57+L65+L76)*I56/100","v":0}]
["1.2.1","In case of subcontracting, will the CSP communicate subcontracting (e.g. name of the subcontractor) details to the tenant?",null,null,{"$f":"IF($D57=\"N/A\",0,1)","v":1},0.33333333333333298,{"$f":"IF(E57,F57*SUM($F$57,$F$65,$F$76,)/($E$57*$F$57+$E$65*$F$65+$E$76*$F$76),0)","v":0.33333333333333298},null,null,{"$f":"IF(ISBLANK($D$57),0,VLOOKUP($D$57,$B$60:$C$63,2,0))","v":0},{"$f":"J57*G57","v":0},{"$f":"IF(ISBLANK(D57),0,IF(D57=\"Unknown\",100*G57,J57*G57))","v":0},{"$f":"IF(D57=B60,\"V\",IF(D57=B61,\"X\",IF(D57=B62,\"??\",IF(D57=B63,\"N/A\",\" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.2.2","In case of subcontracting,  will the CSP inform in advance the tenant of any change in the course of the contract?",null,null,{"$f":"IF($D$65=\"N/A\",0,1)","v":1},0.33333333333333337,{"$f":"IF(E65,F65*SUM($F$57,$F$65,$F$76,)/($E$57*$F$57+$E$65*$F$65+$E$76*$F$76),0)","v":0.33333333333333337},null,null,{"$f":"IF(ISBLANK($D$65),0,VLOOKUP($D$65,$B$71:$C$74,2,0))","v":0},{"$f":"J65*G65","v":0},{"$f":"IF(ISBLANK(D65),0,IF(D65=\"Unknown\",100*G65,J65*G65))","v":0},{"$f":"IF(D65=B71,\"V\",IF(D65=B72,\"X\",IF(D65=B73,\"??\",IF(D65=B74,\"N/A\",\" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. hiring a new subcontractor."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.2.3","In case of subcontracting, does the CSP guarantee contractually to remain fully responsible for his engagements, even with the hiring of subcontractors?",null,null,{"$f":"IF($D$76=\"N/A\",0,1)","v":1},0.33333333333333337,{"$f":"IF(E76,F76*SUM($F$57,$F$65,$F$76,)/($E$57*$F$57+$E$65*$F$65+$E$76*$F$76),0)","v":0.33333333333333337},null,null,{"$f":"IF(ISBLANK($D$76),0,VLOOKUP($D$76,$B$79:$C$82,2,0))","v":0},{"$f":"J76*G76","v":0},{"$f":"IF(ISBLANK(D76),0,IF(D76=\"Unknown\",100*G76,J76*G76))","v":0},{"$f":"IF(D76=B79,\"V\",IF(D76=B80,\"X\",IF(D76=B81,\"??\",IF(D76=B82,\"N/A\",\" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.3","Audit",null,null,{"$f":"IF(AND($D$85=\"N/A\",$D$96=\"N/A\",$D$108=\"N/A\",$D$119=\"N/A\",$D$130=\"N/A\"),0,1)","v":1},{"$f":"(F85+F96+F108+F119+F130)","v":1},{"$f":"(G85+G96+G108+G119+G130)","v":1},0.18,{"$f":"IF(E84,H84*SUM($H$6,$H$56,$H$84,$H$143,$H$177,$H$202,)/($E$6*$H$6+$E$56*$H$56+$E$84*$H$84+$E$143*$H$143+$E$177*$H$177+$E$202*$H$202),0)","v":0.18},null,{"$f":"(K85+K96+K108+K119+K130)*I84/100","v":0},{"$f":"(L85+L96+L108+L119+L130)*I84/100","v":0}]
["1.3.1","At which time interval is the cloud service (including all its subcontractors) audited by a third party?",null,null,{"$f":"IF($D85=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E85,F85*SUM($F$85,$F$96,$F$108,$F$119,$F$130,)/($E$85*$F$85+$E$96*$F$96+$E$108*$F$108+$E$119*$F$119+$E$130*$F$130),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$85),0,VLOOKUP($D$85,$B$88:$C$94,2,0))","v":0},{"$f":"J85*G85","v":0},{"$f":"IF(ISBLANK(D85),0,IF(D85=\"Unknown\",100*G85,J85*G85))","v":0},{"$f":"IF(D85=B88,\"V\",IF(D85=B94,\"??\",IF(D85=\"\",\" \",\"X\")))","v":" "}]
[]
[null,"Score specification"]
[null,"On request by tenant",100]
[null,"≤ 6 months",80]
[null,"1 year",65]
[null,"2 years",35]
[null,"> 2 years",10]
[null,"Never",0]
[null,"Unknown",0]
[]
["1.3.2","If the cloud service is audited, are the scopes of the audits accurately defined?",null,null,{"$f":"IF($D$96=\"N/A\",0,1)","v":1},0.28000000000000003,{"$f":"IF(E96,F96*SUM($F$85,$F$96,$F$108,$F$119,$F$130,)/($E$85*$F$85+$E$96*$F$96+$E$108*$F$108+$E$119*$F$119+$E$130*$F$130),0)","v":0.28000000000000003},null,null,{"$f":"IF(ISBLANK($D$96),0,VLOOKUP($D$96,$B$102:$C$106,2,0))","v":0},{"$f":"J96*G96","v":0},{"$f":"IF(ISBLANK(D96),0,IF(D96=\"Unknown\",100*G96,J96*G96))","v":0},{"$f":"IF(D96=B104,\"X\",IF(D96=B105,\"??\",IF(D96=\"\",\" \",IF(D96=B106,\"N/A\",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question will depend on the answer of question 1.3.1."]
[]
[null,"Score specification"]
[null,"Yes, audit definition fully defined by tenant",100]
[null,"Yes, but tenant has no impact on audit definition",75]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.3.3","At which time interval is the cloud service (including all its subcontractors) vulnerability tested, whereby critical vulnerabilites are fixed?",null,null,{"$f":"IF($D108=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E108,F108*SUM($F$85,$F$96,$F$108,$F$119,$F$130,)/($E$85*$F$85+$E$96*$F$96+$E$108*$F$108+$E$119*$F$119+$E$130*$F$130),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$108),0,VLOOKUP($D$108,$B$111:$C$117,2,0))","v":0},{"$f":"J108*G108","v":0},{"$f":"IF(ISBLANK(D108),0,IF(D108=\"Unknown\",100*G108,J108*G108))","v":0},{"$f":"IF(D108=B115,\"X\",IF(D108=B116,\"X\",IF(D108=B117,\"??\", IF(D108=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"On request by the tenant",100]
[null,"3 months",80]
[null,"6 months",65]
[null,"1 year",35]
[null,"> 1 year",10]
[null,"Never",0]
[null,"Unknown",0]
[]
["1.3.4","Did the cloud service define an ISP (Information Security Policy) and obtain a certification for the relevant security processes?",null,null,{"$f":"IF($D119=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E119,F119*SUM($F$85,$F$96,$F$108,$F$119,$F$130,)/($E$85*$F$85+$E$96*$F$96+$E$108*$F$108+$E$119*$F$119+$E$130*$F$130),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$119),0,VLOOKUP($D$119,$B$125:$C$128,2,0))","v":0},{"$f":"J119*G119","v":0},{"$f":"IF(ISBLANK(D119),0,IF(D119=\"Unknown\",100*G119,J119*G119))","v":0},{"$f":"IF(D119=B127,\"X\",IF(D119=B128,\"??\", IF(D119=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. certificates PCI DSS, HIPAA, ISO 27000, COBIT, SSAE16, SOC2/3, or norm ISAE 3402."]
[]
[null,"Score specification"]
[null,"Yes, only an ISP",60]
[null,"Yes, ISP and certification(s)",100]
[null,"No ISP, no certificatation(s)",0]
[null,"Unknown",0]
[]
["1.3.5","Is there a Tier certification of data centers (especially for physical availability and security) or equivalent certification?",null,null,{"$f":"IF($D$130=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E130,F130*SUM($F$85,$F$96,$F$108,$F$119,$F$130,)/($E$85*$F$85+$E$96*$F$96+$E$108*$F$108+$E$119*$F$119+$E$130*$F$130),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$130),0,VLOOKUP($D$130,$B$136:$C$141,2,0))","v":0},{"$f":"J130*G130","v":0},{"$f":"IF(ISBLANK(D130),0,IF(D130=\"Unknown\",100*G130,J130*G130))","v":0},{"$f":"IF(D130=B140,\"X\",IF(D130=B141,\"??\", IF(D130=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The documents related to the Tier certification can be found at: http://uptimeinstitute.com/"]
[]
[null,"Score specification"]
[null,"Tier 1 or equivalent",35]
[null,"Tier 2 or equivalent",60]
[null,"Tier 3 or equivalent",80]
[null,"Tier 4 or equivalent",100]
[null,"No Tier certification or equivalent",0]
[null,"Unknown",0]
[]
["1.4","Business continuity",null,null,{"$f":"IF(AND($D$144=\"N/A\",$D$152=\"N/A\",$D$164=\"N/A\"),0,1)","v":1},{"$f":"(F144+F152+F164)","v":1},{"$f":"(G144+G152+G164)","v":1},0.18,{"$f":"IF(E143,H143*SUM($H$6,$H$56,$H$84,$H$143,$H$177,$H$202,)/($E$6*$H$6+$E$56*$H$56+$E$84*$H$84+$E$143*$H$143+$E$177*$H$177+$E$202*$H$202),0)","v":0.18},null,{"$f":"(K144+K152+K164)*I143/100","v":0},{"$f":"(L144+L152+L164)*I143/100","v":0}]
["1.4.1","Is the cloud service delivery managed under SLAs (Service Level Agreements)?",null,null,{"$f":"IF($D144=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E144,F144*SUM($F$144,$F$152,$F$164,)/($E$144*$F$144+$E$152*$F$152+$E$164*$F$164),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$144),0,VLOOKUP($D$144,$B$147:$C$150,2,0))","v":0},{"$f":"J144*G144","v":0},{"$f":"IF(ISBLANK(D144),0,IF(D144=\"Unknown\",100*G144,J144*G144))","v":0},{"$f":"IF(D144=B147,\"V\",IF(D144=B148,\"X\",IF(D144=B149,\"??\",IF(D144=B150,\"N/A\",\" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.4.2","Does the CSP define and implement a business continuity plan?",null,null,{"$f":"IF($D152=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E152,F152*SUM($F$144,$F$152,$F$164,)/($E$144*$F$144+$E$152*$F$152+$E$164*$F$164),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$152),0,VLOOKUP($D$152,$B$159:$C$162,2,0))","v":0},{"$f":"J152*G152","v":0},{"$f":"IF(ISBLANK(D152),0,IF(D152=\"Unknown\",100*G152,J152*G152))","v":0},{"$f":"IF(D152=B159,\"V\",IF(D152=B160,\"X\",IF(D152=B161,\"??\",IF(D152=B162,\"N/A\",\" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"This refers to the continuity of the service in case of incident."]
[null,"E.g. British Standard BS 25999 certificate for business continuity management."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.4.3","Is there a contractual clause that guarantees the posibility to migrate/export the data conform legislation (e.g. in a readable, standardized format).",null,null,{"$f":"IF($D164=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E164,F164*SUM($F$144,$F$152,$F$164,)/($E$144*$F$144+$E$152*$F$152+$E$164*$F$164),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$164),0,VLOOKUP($D$164,$B$170:$C$175,2,0))","v":0},{"$f":"J164*G164","v":0},{"$f":"IF(ISBLANK(D164),0,IF(D164=\"Unknown\",100*G164,J164*G164))","v":0},{"$f":"IF(D164=B170,\"X\",IF(D164=B174,\"??\",IF(D164=B175,\"N/A\",IF(D164=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The cloud service should not be a \"vendor lock-in\" service. The data should be in a standard format, and the data recovery should be automated as much as possible to help a potential migration to a new CSP."]
[]
[null,"Score specification"]
[null,"No",0]
[null,"Yes, contractually specified in a \"exit clause\"",50]
[null,"Yes with a regular and cost-efficient export of the data in practical format",80]
[null,"Yes with a regular and cost-efficient export of the data in an agreed or standardized, documented format",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["1.5","Risk mitigation",null,null,{"$f":"IF(AND($D$178=\"N/A\",$D$187=\"N/A\",$D$195=\"N/A\"),0,1)","v":1},{"$f":"(F178+F187+F195)","v":1},{"$f":"(G178+G187+G195)","v":1},0.18,{"$f":"IF(E177,H177*SUM($H$6,$H$56,$H$84,$H$143,$H$177,$H$202,)/($E$6*$H$6+$E$56*$H$56+$E$84*$H$84+$E$143*$H$143+$E$177*$H$177+$E$202*$H$202),0)","v":0.18},null,{"$f":"(K178+K187+K195)*I177/100","v":0},{"$f":"(L178+L187+L195)*I177/100","v":0}]
["1.5.1","Who defines and is responsible for the implementation of risk mitigation measures of the cloud solution?",null,null,{"$f":"IF($D178=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E178,F178*SUM($F$178,$F$187,$F$195,)/($E$178*$F$178+$E$187*$F$187+$E$195*$F$195),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$178),0,VLOOKUP($D$178,$B$181:$C$185,2,0))","v":0},{"$f":"J178*G178","v":0},{"$f":"IF(ISBLANK(D178),0,IF(D178=\"Unknown\",100*G178,J178*G178))","v":0},{"$f":"IF(D178=\"\",\" \",IF(D178=B185,\"??\",\"V\"))","v":" "}]
[]
[null,"Score specification"]
[null,"Only the cloud provider",0]
[null,"Tenant partially defines and cloud provider is responsible for implementation",25]
[null,"Tenant fully defines and cloud provider is responsible for implementation",75]
[null,"Tenant defines and cloud provider is fully transparent about the implementation",100]
[null,"Unknown",-1]
[]
["1.5.2","When can the tenant (re-)define risk mitigation measures?",null,null,{"$f":"IF($D187=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E187,F187*SUM($F$178,$F$187,$F$195,)/($E$178*$F$178+$E$187*$F$187+$E$195*$F$195),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$187),0,VLOOKUP($D$187,$B$190:$C$193,2,0))","v":0},{"$f":"J187*G187","v":0},{"$f":"IF(ISBLANK(D187),0,IF(D187=\"Unknown\",100*G187,J187*G187))","v":0},{"$f":"IF(D187=B191,\"V\",IF(D187=B192,\"X\",IF(D187=B193,\"??\",IF(D187=B190,\"V\",\" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"At initial contract & setup",50]
[null,"At any time",100]
[null,"Never",0]
[null,"Unknown",0]
[]
["1.5.3","Does the cloud provider have the right to unilaterally change risk mitigation measured",null,null,{"$f":"IF($D195=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E195,F195*SUM($F$178,$F$187,$F$195,)/($E$178*$F$178+$E$187*$F$187+$E$195*$F$195),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$195),0,VLOOKUP($D$195,$B$198:$C$200,2,0))","v":0},{"$f":"J195*G195","v":0},{"$f":"IF(ISBLANK(D195),0,IF(D195=\"Unknown\",100*G195,J195*G195))","v":0},{"$f":"IF(D195=B199,\"V\",IF(D195=B198,\"X\",IF(D195=B200,\"??\",\" \")))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",0]
[null,"No",100]
[null,"Unknown",0]
[]
["1.6","Others",null,null,{"$f":"IF(AND($D$203=\"N/A\",$D$211=\"N/A\"),0,1)","v":1},{"$f":"(F211)+F203","v":1},{"$f":"(G211+G203)","v":1},0.1,{"$f":"IF(E202,H202*SUM($H$6,$H$56,$H$84,$H$143,$H$177,$H$202,)/($E$6*$H$6+$E$56*$H$56+$E$84*$H$84+$E$143*$H$143+$E$177*$H$177+$E$202*$H$202),0)","v":0.1},null,{"$f":"(K211+K203)*I202/100","v":0},{"$f":"(L211)*I202/100","v":0}]
["1.6.1","Is the collection and further processing of the metadata transparant, are the objectives clear and is it clear who is the owner of the data?",null,null,{"$f":"IF($D203=\"N/A\",0,1)","v":1},0.6,{"$f":"IF(E203,F203*SUM($F$203,$F$211,)/($E$203*$F$203+$E$211*$F$211),0)","v":0.6},null,null,{"$f":"IF(ISBLANK($D$203),0,VLOOKUP($D$203,$B$206:$C$209,2,0))","v":0},{"$f":"J203*G203","v":0},{"$f":"IF(ISBLANK(D203),0,IF(D203=\"Unknown\",100*G203,J203*G203))","v":0},{"$f":"IF(D203=\"\",\" \",IF(D203=B208,\"X\",IF(D203=B209,\"??\",\"V\")))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, processing clearly agreed with tenant",100]
[null,"Yes, processing potentially also used for other purposes",50]
[null,"No",0]
[null,"Unknown",0]
[]
["1.6.2","Configuration and change mangement is transparent and CSP assets (hardware, software, data) are tracked throughout their lifetime in service.",null,null,{"$f":"IF($D211=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E211,F211*SUM(,$F$211,)/($E$211*$F$211),0)","v":0.40000000000000008},null,null,{"$f":"IF(ISBLANK($D$211),0,VLOOKUP($D$211,$B$214:$C$216,2,0))","v":0},{"$f":"J211*G211","v":0},{"$f":"IF(ISBLANK(D211),0,IF(D211=\"Unknown\",100*G211,J211*G211))","v":0},{"$f":"IF(D211=B214,\"V\",IF(D211=B215,\"X\",IF(D211=B216,\"??\",\" \")))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes ",100]
[null,"No",0]
[null,"Unknown",0]
[]
[2,"Identity and Access Management (IAM)",null,null,null,null,null,{"$f":"(H219+H266)","v":1},{"$f":"(I219+I266)","v":1},null,{"$f":"(K219+K266)","v":0},{"$f":"(L219+L266)","v":0}]
["2.1","CSP administrators",null,null,{"$f":"IF(AND($D$220=\"N/A\",$D$231=\"N/A\",$D$244=\"N/A\",$D$253=\"N/A\"),0,1)","v":1},{"$f":"(F220+F231+F244+F253)","v":1},{"$f":"(G220+G231+G244+G253)","v":1},0.5,{"$f":"IF(E219,H219*SUM($H$219,$H$266)/($E$219*$H$219+$E$266*$H$266),0)","v":0.5},null,{"$f":"(K220+K231+K244+K253)*I219/100","v":0},{"$f":"(L220+L231+L244+L253)*I219/100","v":0}]
["2.1.1","What is the (lowest) authentication level of CSP administrators",null,null,{"$f":"IF($D220=\"N/A\",0,1)","v":1},0.25,{"$f":"IF(E220,F220*SUM($F$220,$F$231,$F$244,$F$253,)/($E$220*$F$220+$E$231*$F$231+$E$244*$F$244+$E$253*$F$253),0)","v":0.25},null,null,{"$f":"IF(ISBLANK($D$220),0,VLOOKUP($D$220,$B$226:$C$229,2,0))","v":0},{"$f":"J220*G220","v":0},{"$f":"IF(ISBLANK(D220),0,IF(D220=\"Unknown\",100*G220,J220*G220))","v":0},{"$f":"IF(D220=B228,\"X\",IF(D220=B229,\"??\",IF(D220=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The assurance levels (low, substantial, high) are defined by the eIDAS regulation"]
[]
[null,"Score specification"]
[null,"High",90]
[null,"Substantial",60]
[null,"Low",30]
[null,"Unknown",0]
[]
["2.1.2","How strong are the authorization enforcement rules to access tenants assets (=data & code) or the CSP's system",null,null,{"$f":"IF($D231=\"N/A\",0,1)","v":1},0.25,{"$f":"IF(E231,F231*SUM($F$220,$F$231,$F$244,$F$253)/($E$220*$F$220+$E$231*$F$231+$E$244*$F$244+$E$253*$F$253),0)","v":0.25},null,null,{"$f":"IF(ISBLANK($D$231),0,VLOOKUP($D$231,$B$237:$C$242,2,0))","v":0},{"$f":"J231*G231","v":0},{"$f":"IF(ISBLANK(D231),0,IF(D231=\"Unknown\",100*G231,J231*G231))","v":0},{"$f":"IF(D231=B241,\"X\",IF(D231=B242,\"??\",IF(D231=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"Need to know: Access only to data that need to be known at the time it needs to be know\nLeast privilige: Admins (and processes) have only the stricly required rights to perform their tasks.\nSeparation of duties. More than one person is required to complete a task."]
[]
[null,"Score specification"]
[null,"Need to know & separation of duties",90]
[null,"Least privilige  & separation of duties",70]
[null,"Need to know & no separation of duties",50]
[null,"Least privilige  & no separation of duties",30]
[null,"Nothing foreseen",0]
[null,"Unknown",0]
[]
["2.1.3","Authorization detection control to both tenants assets (=data & code) and CSP's system",null,null,{"$f":"IF($D244=\"N/A\",0,1)","v":1},0.25,{"$f":"IF(E244,F244*SUM($F$220,$F$231,$F$244,$F$253)/($E$220*$F$220+$E$231*$F$231+$E$244*$F$244+$E$253*$F$253),0)","v":0.25},null,null,{"$f":"IF(ISBLANK($D$244),0,VLOOKUP($D$244,$B$247:$C$251,2,0))","v":0},{"$f":"J244*G244","v":0},{"$f":"IF(ISBLANK(D244),0,IF(D244=\"Unknown\",100*G244,J244*G244))","v":0},{"$f":"IF(D244=B250,\"X\",IF(D244=B251,\"??\",IF(D244=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Score specification"]
[null,"Monitoring & logging",100]
[null,"Monitoring",50]
[null,"Logging",50]
[null,"None",0]
[null,"Unknown",0]
[]
["2.1.4","Are authentication and authorization rules well documented?",null,null,{"$f":"IF($D253=\"N/A\",0,1)","v":1},0.25,{"$f":"IF(E253,F253*SUM($F$220,$F$231,$F$244,$F$253,)/($E$220*$F$220+$E$231*$F$231+$E$244*$F$244+$E$253*$F$253),0)","v":0.25},null,null,{"$f":"IF(ISBLANK($D$253),0,VLOOKUP($D$253,$B$259:$C$263,2,0))","v":0},{"$f":"J253*G253","v":0},{"$f":"IF(ISBLANK(D253),0,IF(D253=\"Unknown\",100*G253,J253*G253))","v":0},{"$f":"IF(D253=B262,\"X\",IF(D253=B263,\"??\",IF(D253=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. to change password each month."]
[]
[null,"Score specification"]
[null,"Yes, Complete, clear & regularly communicated to involved entities",100]
[null,"Yes, Complete, clear & but not pushed to involved entities",80]
[null,"Yes, but insufficiently complete or clear",50]
[null,"No",0]
[null,"Unknown",0]
[]
[]
["2.2","End-users and admins at the tenant side",null,null,{"$f":"IF(AND($D$267=\"N/A\",$D$277=\"N/A\",$D$289=\"N/A\",$D$299=\"N/A\",$D$309=\"N/A\"),0,1)","v":1},{"$f":"(F267+F277+F289+F299+F309)","v":1},{"$f":"(G267+G277+G289+G299+G309)","v":1},0.5,{"$f":"IF(E266,H266*SUM($H$219,$H$266)/($E$219*$H$219+$E$266*$H$266),0)","v":0.5},null,{"$f":"(K267+K277+K289+K299+K309)*I266/100","v":0},{"$f":"(L267+L277+L289+L299)*I266/100","v":0}]
["2.2.1","Is integration with the authentication system of the tenant (or third party) possible?",null,null,{"$f":"IF($D267=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E267,F267*SUM($F$267,$F$277,$F$289,$F$299,$F$309,)/($E$267*$F$267+$E$277*$F$277+$E$289*$F$289+$E$299*$F$299+$E$309*$F$309),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$267),0,VLOOKUP($D$267,$B$270:$C$275,2,0))","v":0},{"$f":"J267*G267","v":0},{"$f":"IF(ISBLANK(D267),0,IF(D267=\"Unknown\",100*G267,J267*G267))","v":0},{"$f":"IF(D267=B273,\"X\",IF(D267=B274,\"??\",IF(D267=\"\",\" \",IF(D267=B275,\"N/A\",\"V\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes,both LDAP and identity provider can be integrated",100]
[null,"Yes,only identity provider can be integrated",75]
[null,"Yes,only LDAP can be integrated",50]
[null,"No",25]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.2","What is the strongest level of authentication available?",null,null,{"$f":"IF($D277=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E277,F277*SUM($F$267,$F$277,$F$289,$F$299,$F$309,)/($E$267*$F$267+$E$277*$F$277+$E$289*$F$289+$E$299*$F$299+$E$309*$F$309),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$277),0,VLOOKUP($D$277,$B$283:$C$287,2,0))","v":0},{"$f":"J277*G277","v":0},{"$f":"IF(ISBLANK(D277),0,IF(D277=\"Unknown\",100*G277,J277*G277))","v":0},{"$f":"IF(D277=B285,\"X\",IF(D277=B286,\"??\",IF(D277=\"\",\" \",IF(D277=B287,\"N/A\",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"Only relevant if answer on previous question is 'no'. According to eIDAS assurance levels."]
[]
[null,"Score specification"]
[null,"High",100]
[null,"Substantial",60]
[null,"Low",20]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.3","Is authorization detection control by the CSP to both tenants assets (=data & code) and CSP's system in place?",null,null,{"$f":"IF($D289=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E289,F289*SUM($F$267,$F$277,$F$289,$F$299,$F$309,)/($E$267*$F$267+$E$277*$F$277+$E$289*$F$289+$E$299*$F$299+$E$309*$F$309),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$289),0,VLOOKUP($D$289,$B$292:$C$297,2,0))","v":0},{"$f":"J289*G289","v":0},{"$f":"IF(ISBLANK(D289),0,IF(D289=\"Unknown\",100*G289,J289*G289))","v":0},{"$f":"IF(D289=B295,\"X\",IF(D289=B296,\"??\",IF(D289=\"\",\" \",IF(D289=B297,\"N/A\",\"V\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, monitoring & logging",100]
[null,"Yes, monitoring",50]
[null,"Yes, logging",50]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.4","Are authentication and authorization rules by CSP well documented?",null,null,{"$f":"IF($D299=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E299,F299*SUM($F$267,$F$277,$F$289,$F$299,$F$309,)/($E$267*$F$267+$E$277*$F$277+$E$289*$F$289+$E$299*$F$299+$E$309*$F$309),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$299),0,VLOOKUP($D$299,$B$302:$C$306,2,0))","v":0},{"$f":"J299*G299","v":0},{"$f":"IF(ISBLANK(D299),0,IF(D299=\"Unknown\",100*G299,J299*G299))","v":0},{"$f":"IF(D299=B305,\"X\",IF(D299=B306,\"??\",IF(D299=\"\",\" \",IF(D299=B307,\"N/A\",IF(D299=B304,\"X\",\"V\")))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, Complete, clear & regularly communicated to involved entities",100]
[null,"Yes, Complete, clear & but not pushed to involved entities",80]
[null,"Yes, but insufficiently complete or clear",50]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["2.2.5","Can the tenants define in a fine-grained way the authorization enforcement rules for the tenants assets at the CSP?",null,null,{"$f":"IF($D309=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E309,F309*SUM($F$267,$F$277,$F$289,$F$299,$F$309,)/($E$267*$F$267+$E$277*$F$277+$E$289*$F$289+$E$299*$F$299+$E$309*$F$309),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$309),0,VLOOKUP($D$309,$B$312:$C$316,2,0))","v":0},{"$f":"J309*G309","v":0},{"$f":"IF(ISBLANK(D309),0,IF(D309=\"Unknown\",100*G309,J309*G309))","v":0},{"$f":"IF(D309=B314,\"X\",IF(D309=B315,\"??\",IF(D309=\"\",\" \",IF(D309=B316,\"N/A\",IF(D309=B313,\"X\",\"V\")))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"Yes, but in a fine-grained way",50]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
[]
[3,"IT Security",null,null,null,null,null,{"$f":"(H320+H351+H372+H431)","v":1},{"$f":"(I320+I351+I372+I431)","v":1},null,{"$f":"(K320+K351+K372+K431)","v":0},{"$f":"(L320+L351+L372+L431)","v":0}]
["3.1","Segregation of data",null,null,{"$f":"IF(AND($D$321=\"N/A\",$D$331=\"N/A\",$D$342=\"N/A\"),0,1)","v":1},{"$f":"(F321+F331+F342)","v":1},{"$f":"(G321+G331+G342)","v":1},0.23,{"$f":"IF(E320,H320*SUM($H$320,$H$351,$H$372,$H$431,)/($E$320*$H$320+$E$351*$H$351+$E$372*$H$372+$E$431*$H$431),0)","v":0.23},null,{"$f":"(K321+K331+K342)*I320/100","v":0},{"$f":"(L321+L331)*I320/100","v":0}]
["3.1.1","Can the cloud service be provided as private or community?",null,null,{"$f":"IF($D321=\"N/A\",0,1)","v":1},0.33333333333333337,{"$f":"IF(E321,F321*SUM($F$321,$F$331,F$342)/($E$321*$F$321+$E$331*$F$331+$E$342*$F$342),0)","v":0.33333333333333337},null,null,{"$f":"IF(ISBLANK($D$321),0,VLOOKUP($D$321,$B$327:$C$329,2,0))","v":0},{"$f":"J321*G321","v":0},{"$f":"IF(ISBLANK(D321),0,IF(D321=\"Unknown\",100*G321,J321*G321))","v":0},"N/A"]
[]
[null,"Explanations / Examples"]
[null,"This might be useful when a separated instance for a governmental institution is needed."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[]
["3.1.2","In a multi-tenant system, are the data of the respective tenants segregated/isolated in such a way that it is technically impossible for any user of tenant A to receive entitlements to data of tenant B?",null,null,{"$f":"IF($D$331=\"N/A\",0,1)","v":1},0.33333333333333337,{"$f":"IF(E331,F331*SUM($F$321,$F$331,F$342)/($E$321*$F$321+$E$331*$F$331+$E$342*$F$342),0)","v":0.33333333333333337},null,null,{"$f":"IF(ISBLANK($D$331),0,VLOOKUP($D$331,$B$337:$C$340,2,0))","v":0},{"$f":"J331*G331","v":0},{"$f":"IF(ISBLANK(D331),0,IF(D331=\"Unknown\",100*G331,J331*G331))","v":0},{"$f":"IF(D331=B338,\"X\",IF(D331=B339,\"??\",IF(D331=\"\",\" \",IF(D331=B340,\"N/A\",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. VLAN isolation, data-at-rest encryption, user choice of the datacenter."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.1.3","Is physical machine shared by multiple tenants",null,null,{"$f":"IF($D$331=\"N/A\",0,1)","v":1},0.33333333333333337,{"$f":"IF(E342,F342*SUM($F$321,$F$331,F$342)/($E$321*$F$321+$E$331*$F$331+$E$342*$F$342),0)","v":0.33333333333333337},null,null,{"$f":"IF(ISBLANK($D$342),0,VLOOKUP($D$342,$B$345:$C$349,2,0))","v":0},{"$f":"J342*G342","v":0},{"$f":"IF(ISBLANK(D342),0,IF(D342=\"Unknown\",100*G342,J342*G342))","v":0},{"$f":"IF(D342=B347,\"X\",IF(D342=B346,\"V\",IF(D342=\"\",\" \",IF(D342=B349,\"N/A\",IF(D342=B345,\"V\",IF(D342=B348,\"??\",\" \"))))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, community tenants or known trusted tenants",50]
[null,"Yes, unknown tenants",0]
[null,"No",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.2","Interface security",null,null,{"$f":"IF(AND($D$352=\"N/A\",$D$363=\"N/A\"),0,1)","v":1},{"$f":"(F352+F363)","v":1},{"$f":"(G352+G363)","v":1},0.23,{"$f":"IF(E351,H351*SUM($H$320,$H$351,$H$372,$H$431,)/($E$320*$H$320+$E$351*$H$351+$E$372*$H$372+$E$431*$H$431),0)","v":0.23},null,{"$f":"(K352+K363)*I351/100","v":0},{"$f":"(L352+L363)*I351/100","v":0}]
["3.2.1","Are APIs developed in accordance with standards?",null,null,{"$f":"IF($D352=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E352,F352*SUM($F$352,$F$363,)/($E$352*$F$352+$E$363*$F$363),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$352),0,VLOOKUP($D$352,$B$358:$C$361,2,0))","v":0},{"$f":"J352*G352","v":0},{"$f":"IF(ISBLANK(D352),0,IF(D352=\"Unknown\",100*G352,J352*G352))","v":0},"N/A"]
[]
[null,"Explanations / Examples"]
[null,"E.g. following the OWASP guidelines."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.2.2","Are data integrity and confidentiality ensured during communication?",null,null,{"$f":"IF($D363=\"N/A\",0,1)","v":1},0.7,{"$f":"IF(E363,F363*SUM($F$352,$F$363,)/($E$352*$F$352+$E$363*$F$363),0)","v":0.7},null,null,{"$f":"IF(ISBLANK($D$363),0,VLOOKUP($D$363,$B$366:$C$370,2,0))","v":0},{"$f":"J363*G363","v":0},{"$f":"IF(ISBLANK(D363),0,IF(D363=\"Unknown\",100*G363,J363*G363))","v":0},{"$f":"IF(D363=B366,\"V\",IF(D363=B369,\"??\",IF(D363=B370,\"N/A\",IF(D363=\"\",\" \",\"X\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, strong, rigorous procedures and governance by both certificate authority (CA) and CSP",100]
[null,"Yes, but governance by certificate authority (CA) or CSP unclear or insuffienctly strong/rigorous",50]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3","Infrastructure and virtualization security",null,null,{"$f":"IF(AND($D$373=\"N/A\",$D$384=\"N/A\",$D$397=\"N/A\",$D$408=\"N/A\",$D$420=\"N/A\"),0,1)","v":1},{"$f":"(F373+F384+F397+F408+F420)","v":1},{"$f":"(G373+G384+G397+G408+G420)","v":1},0.24,{"$f":"IF(E372,H372*SUM($H$320,$H$351,$H$372,$H$431,)/($E$320*$H$320+$E$351*$H$351+$E$372*$H$372+$E$431*$H$431),0)","v":0.24},null,{"$f":"(K373+K384+K397+K408+K420)*I372/100","v":0},{"$f":"(L373+L384+L397+L408+L420)*I372/100","v":0}]
["3.3.1","Is the access to hypervisors management functions and administration consoles highly controlled?",null,null,{"$f":"IF($D373=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E373,F373*SUM($F$373,$F$384,$F$397,$F$408,$F$420,)/($E$373*$F$373+$E$384*$F$384+$E$397*$F$397+$E$408*$F$408+$E$420*$F$420),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$373),0,VLOOKUP($D$373,$B$379:$C$382,2,0))","v":0},{"$f":"J373*G373","v":0},{"$f":"IF(ISBLANK(D373),0,IF(D373=\"Unknown\",100*G373,J373*G373))","v":0},{"$f":"IF(D373=B379,\"V\",IF(D373=B380,\"X\",IF(D373=B382,\"N/A\",IF(D373=B381,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with strong authentication, SSL/TLS communication."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.2","Is data securely deleted from all storage media when the user’s or tenant’s account is deleted within defined timeframes?",null,null,{"$f":"IF($D384=\"N/A\",0,1)","v":1},0.28000000000000003,{"$f":"IF(E384,F384*SUM($F$373,$F$384,$F$397,$F$408,$F$420,)/($E$373*$F$373+$E$384*$F$384+$E$397*$F$397+$E$408*$F$408+$E$420*$F$420),0)","v":0.28000000000000003},null,null,{"$f":"IF(ISBLANK($D$384),0,VLOOKUP($D$384,$B$392:$C$395,2,0))","v":0},{"$f":"J384*G384","v":0},{"$f":"IF(ISBLANK(D384),0,IF(D384=\"Unknown\",100*G384,J384*G384))","v":0},{"$f":"IF(D384=B392,\"V\",IF(D384=B393,\"X\",IF(D384=B395,\"N/A\",IF(D384=B394,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The deletion must absolutely erase all copies of data, except meta-data that might be kept for judicial or accounting requirements."]
[null,"After deletion, the data should not be forensically recoverable."]
[null,"E.g. with cryptographic wiping, demagnetize data storage."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.3","Does the CSP take defense-in-depth approach to wired or wireless network security?",null,null,{"$f":"IF($D397=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E397,F397*SUM($F$373,$F$384,$F$397,$F$408,$F$420,)/($E$373*$F$373+$E$384*$F$384+$E$397*$F$397+$E$408*$F$408+$E$420*$F$420),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$397),0,VLOOKUP($D$397,$B$403:$C$406,2,0))","v":0},{"$f":"J397*G397","v":0},{"$f":"IF(ISBLANK(D397),0,IF(D397=\"Unknown\",100*G397,J397*G397))","v":0},{"$f":"IF(D397=B403,\"V\",IF(D397=B404,\"X\",IF(D397=B406,\"N/A\",IF(D397=B405,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with firewalls, APT detection tools."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.4","Are controls at the hardware and virtual (if applicable) levels present and well documented?",null,null,{"$f":"IF($D408=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E408,F408*SUM($F$373,$F$384,$F$397,$F$408,$F$420,)/($E$373*$F$373+$E$384*$F$384+$E$397*$F$397+$E$408*$F$408+$E$420*$F$420),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$408),0,VLOOKUP($D$408,$B$414:$C$418,2,0))","v":0},{"$f":"J408*G408","v":0},{"$f":"IF(ISBLANK(D408),0,IF(D408=\"Unknown\",100*G408,J408*G408))","v":0},{"$f":"IF(D408=B414,\"V\",IF(D408=B416,\"X\",IF(D408=B418,\"N/A\",IF(D408=B417,\"??\", IF(D408=B415,\"X\",\" \")))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. only used ports opened, file integrity monitoring, logging, IDS/IPS."]
[]
[null,"Score specification"]
[null,"Yes, highest level controls",100]
[null,"Yes, but controls could be substantially improved",60]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.3.5","Are security mechanisms to prevent and analyze data leakage at the hardware and virtual (if applicable) levels available?",null,null,{"$f":"IF($D420=\"N/A\",0,1)","v":1},0.18,{"$f":"IF(E420,F420*SUM($F$373,$F$384,$F$397,$F$408,$F$420,)/($E$373*$F$373+$E$384*$F$384+$E$397*$F$397+$E$408*$F$408+$E$420*$F$420),0)","v":0.18},null,null,{"$f":"IF(ISBLANK($D$420),0,VLOOKUP($D$420,$B$426:$C$429,2,0))","v":0},{"$f":"J420*G420","v":0},{"$f":"IF(ISBLANK(D420),0,IF(D420=\"Unknown\",100*G420,J420*G420))","v":0},{"$f":"IF(D420=B426,\"V\",IF(D420=B427,\"X\",IF(D420=B429,\"N/A\",IF(D420=B428,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with DLP."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4","Cryptography for the protection of the tenant's data",null,null,{"$f":"IF(AND($D$432=\"N/A\",$D$443=\"N/A\",$D$451=\"N/A\",$D$465=\"N/A\",$D$480=\"N/A\",$D$491=\"N/A\",$D$502=\"N/A\"),0,1)","v":1},{"$f":"(F432+F443+F451+F465+F480+F491+F502)","v":1},{"$f":"(G432+G443+G451+G465+G480+G491+G502)","v":1},0.3,{"$f":"IF(E431,H431*SUM($H$320,$H$351,$H$372,$H$431,)/($E$320*$H$320+$E$351*$H$351+$E$372*$H$372+$E$431*$H$431),0)","v":0.3},null,{"$f":"(K432+K443+K451+K465+K480+K491+K502)*I431/100","v":0},{"$f":"(L432+L443+L451+L465+L480+L491+L502)*I431/100","v":0}]
["3.4.1","Who is in charge of the key management?",null,null,{"$f":"IF($D432=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E432,F432*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$432),0,VLOOKUP($D$432,$B$435:$C$441,2,0))","v":0},{"$f":"J432*G432","v":0},{"$f":"IF(ISBLANK(D432),0,IF(D432=\"Unknown\",100*G432,J432*G432))","v":0},"N/A"]
[]
[null,"Score specification"]
[null,"Tenant user",100]
[null,"Tenant system administrator",80]
[null,"Trusted third party (e.g. key management provider)",60]
[null,"CSP",40]
[null,"Subcontractor",20]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.2","Has the key management been defined through policies and procedures as required by the ISO/IEC27002:2013 standard?",null,null,{"$f":"IF($D443=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E443,F443*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$443),0,VLOOKUP($D$443,$B$446:$C$449,2,0))","v":0},{"$f":"J443*G443","v":0},{"$f":"IF(ISBLANK(D443),0,IF(D443=\"Unknown\",100*G443,J443*G443))","v":0},"N/A"]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.3","Have the cryptographic mechanisms used for the cloud service been defined to guarantee adequate cryptographic strength?",null,null,{"$f":"IF($D451=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E451,F451*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$451),0,VLOOKUP($D$451,$B$457:$C$463,2,0))","v":0},{"$f":"J451*G451","v":0},{"$f":"IF(ISBLANK(D451),0,IF(D451=\"Unknown\",100*G451,J451*G451))","v":0},{"$f":"IF(D451=\"\",\" \",IF(D451=B462,\"??\",IF(D451=B463,\"N/A\",IF(D451=B457,\"X\",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. following the NIST standards of algorithms and key length. See keylength.com for most recent recommendations"]
[]
[null,"Score specification"]
[null,"No",0]
[null,"Adequate protection for less than 10 years",30]
[null,"Near-term adequate protection (up to 10 years)",50]
[null,"Protection 30 to 50 years",80]
[null,"Protection for over 50 years",100]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.4","Does the CSP use HSMs (Hardware Security Modules) for the protection of keys?",null,null,{"$f":"IF($D465=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E465,F465*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$465),0,VLOOKUP($D$465,$B$471:$C$478,2,0))","v":0},{"$f":"J465*G465","v":0},{"$f":"IF(ISBLANK(D465),0,IF(D465=\"Unknown\",100*G465,J465*G465))","v":0},{"$f":"IF(D465=\"\",\" \",IF(D465=B476,\"??\",IF(D465=B477,\"??\",IF(D465=B471,\"X\",IF(D465=B478,\"N/A\",\"V\")))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"See FIPS 140-2 for definition of the four levels"]
[]
[null,"Score specification"]
[null,"No",0]
[null,"Yes, level 1",25]
[null,"Yes, level 2",50]
[null,"Yes, level 3",75]
[null,"Yes, level 4",100]
[null,"Yes, but unknown level",25]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.5","Is tenant-side encryption of data possible?",null,null,{"$f":"IF($D480=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E480,F480*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$480),0,VLOOKUP($D$480,$B$486:$C$489,2,0))","v":0},{"$f":"J480*G480","v":0},{"$f":"IF(ISBLANK(D480),0,IF(D480=\"Unknown\",100*G480,J480*G480))","v":0},{"$f":"IF(D480=B486,\"V\",IF(D480=B487,\"X\",IF(D480=B489,\"N/A\",IF(D480=B488,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"This may prevent the CSP and potential subcontractors from obtaining the data in clear if they do not manage the keys."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.6","Is the confidentiality of the data-at-rest, stored by the CSP, cryptographically ensured?",null,null,{"$f":"IF($D491=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E491,F491*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$491),0,VLOOKUP($D$491,$B$497:$C$500,2,0))","v":0},{"$f":"J491*G491","v":0},{"$f":"IF(ISBLANK(D491),0,IF(D491=\"Unknown\",100*G491,J491*G491))","v":0},{"$f":"IF(D491=B497,\"V\",IF(D491=B498,\"X\",IF(D491=B500,\"N/A\",IF(D491=B499,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with encryption."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["3.4.7","Is the integrity of the data-at-rest, stored by the CSP, cryptographically ensured?",null,null,{"$f":"IF($D502=\"N/A\",0,1)","v":1},0.14000000000000001,{"$f":"IF(E502,F502*SUM($F$432,$F$443,$F$451,$F$465,$F$480,$F$491,$F$502,)/($E$432*$F$432+$E$443*$F$443+$E$451*$F$451+$E$465*$F$465+$E$480*$F$480+$E$491*$F$491+$E$502*$F$502),0)","v":0.14000000000000001},null,null,{"$f":"IF(ISBLANK($D$502),0,VLOOKUP($D$502,$B$508:$C$511,2,0))","v":0},{"$f":"J502*G502","v":0},{"$f":"IF(ISBLANK(D502),0,IF(D502=\"Unknown\",100*G502,J502*G502))","v":0},{"$f":"IF(D502=B508,\"V\",IF(D502=B509,\"X\",IF(D502=B511,\"N/A\",IF(D502=B510,\"??\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. with digital signature, hashing, MACs, ...."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
[4,"Operational Security",null,null,null,null,null,{"$f":"(H514+H570+H597)","v":1},{"$f":"(I514+I570+I597)","v":1},null,{"$f":"(K514+K570+K597)","v":0},{"$f":"(L514+L570+L597)","v":0}]
["4.1","Backup and disaster recovery",null,null,{"$f":"IF(AND($D$515=\"N/A\",$D$523=\"N/A\",$D$531=\"N/A\",$D$545=\"N/A\",$D$560=\"N/A\"),0,1)","v":1},{"$f":"(F515+F523+F531+F545+F560)","v":1},{"$f":"(G515+G523+G531+G545+G560)","v":1},0.34,{"$f":"IF(E514,H514*SUM($H$514,$H$570,$H$597)/($E$514*$H$514+$E$570*$H$570+$E$597*$H$597),0)","v":0.34},null,{"$f":"(K515+K523+K531+K545+K560)*I514/100","v":0},{"$f":"(L515+L523+L531+L545+L560)*I514/100","v":0}]
["4.1.1","Can the backup retention plan be defined by the tenant?",null,null,{"$f":"IF($D515=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E515,F515*SUM($F$515,$F$523,$F$531,$F$545,$F$560,)/($E$515*$F$515+E$523*$F$523+$E$531*$F$531+$E$545*$F$545+$E$560*$F$560),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$515),0,VLOOKUP($D$515,$B$518:$C$521,2,0))","v":0},{"$f":"J515*G515","v":0},{"$f":"IF(ISBLANK(D515),0,IF(D515=\"Unknown\",100*G515,J515*G515))","v":0},{"$f":"IF(D515=B521,\"N/A\",IF(D515=B520,\"??\",IF(D515=B519,\"X\",IF(D515=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.2","Are backup controls defined and adequate?",null,null,{"$f":"IF($D523=\"N/A\",0,1)","v":1},0.3,{"$f":"IF(E523,F523*SUM($F$515,$F$523,$F$531,$F$545,$F$560,)/($E$515*$F$515+E$523*$F$523+$E$531*$F$531+$E$545*$F$545+$E$560*$F$560),0)","v":0.3},null,null,{"$f":"IF(ISBLANK($D$523),0,VLOOKUP($D$523,$B$526:$C$529,2,0))","v":0},{"$f":"J523*G523","v":0},{"$f":"IF(ISBLANK(D523),0,IF(D523=\"Unknown\",100*G523,J523*G523))","v":0},{"$f":"IF(D523=B529,\"N/A\",IF(D523=B528,\"??\",IF(D523=B527,\"X\",IF(D523=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.3","Which RTO (Recovery Time objective) can be satisfied by the CSP?",null,null,{"$f":"IF($D531=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E531,F531*SUM($F$515,$F$523,$F$531,$F$545,$F$560,)/($E$515*$F$515+E$523*$F$523+$E$531*$F$531+$E$545*$F$545+$E$560*$F$560),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$531),0,VLOOKUP($D$531,$B$537:$C$543,2,0))","v":0},{"$f":"J531*G531","v":0},{"$f":"IF(ISBLANK(D531),0,IF(D531=\"Unknown\",100*G531,J531*G531))","v":0},{"$f":"IF(D531=B543,\"N/A\",IF(D531=B542,\"??\",IF(D531=B537,\"X\",IF(D531=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"This is the time within which the cloud service must be restored after a disaster."]
[]
[null,"Score specification"]
[null,"No RTO",0]
[null,"< 1 hour",100]
[null,"< 4 hours",80]
[null,"< 1 day",60]
[null,"< 1 week",10]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.4","Which RPO (Recovery Point objective) can be satisfied by the cloud service?",null,null,{"$f":"IF($D545=\"N/A\",0,1)","v":1},0.15,{"$f":"IF(E545,F545*SUM($F$515,$F$523,$F$531,$F$545,$F$560,)/($E$515*$F$515+E$523*$F$523+$E$531*$F$531+$E$545*$F$545+$E$560*$F$560),0)","v":0.15},null,null,{"$f":"IF(ISBLANK($D$545),0,VLOOKUP($D$545,$B$551:$C$558,2,0))","v":0},{"$f":"J545*G545","v":0},{"$f":"IF(ISBLANK(D545),0,IF(D545=\"Unknown\",100*G545,J545*G545))","v":0},{"$f":"IF(D545=B558,\"N/A\",IF(D545=B557,\"??\",IF(D545=B551,\"X\",IF(D545=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"This is the maximum period in which data might be lost by the cloud service due to a disaster."]
[]
[null,"Score specification"]
[null,"No RPO",0]
[null,"5 minutes",100]
[null,"1 hour",90]
[null,"1 day",50]
[null,"1 week",20]
[null,"More than a week",10]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.1.5","Are tenants able to initiate recovery tests, including reporting?",null,null,{"$f":"IF($D560=\"N/A\",0,1)","v":1},0.1,{"$f":"IF(E560,F560*SUM($F$515,$F$523,$F$531,$F$545,$F$560,)/($E$515*$F$515+E$523*$F$523+$E$531*$F$531+$E$545*$F$545+$E$560*$F$560),0)","v":0.1},null,null,{"$f":"IF(ISBLANK($D$560),0,VLOOKUP($D$560,$B$563:$C$568,2,0))","v":0},{"$f":"J560*G560","v":0},{"$f":"IF(ISBLANK(D560),0,IF(D560=\"Unknown\",100*G560,J560*G560))","v":0},{"$f":"IF(D560=B568,\"N/A\",IF(D560=B567,\"??\",IF(D560=B566,\"X\",IF(D560=\"\",\" \",\"V\"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, at any time",100]
[null,"Yes, multiple times per year",90]
[null,"Yes, once a year",50]
[null,"No",0]
[null,"Unknown",0]
[null,"N/A",-1]
[]
["4.2","Incident management",null,null,{"$f":"IF(AND($D$571=\"N/A\",$D$579=\"N/A\",$D$587=\"N/A\"),0,1)","v":1},{"$f":"(F571+F579+F587)","v":1},{"$f":"(G571+G579+G587)","v":1},0.33,{"$f":"IF(E570,H570*SUM($H$514,$H$570,$H$597)/($E$514*$H$514+$E$570*$H$570+$E$597*$H$597),0)","v":0.33},null,{"$f":"(K571+K579+K587)*I570/100","v":0},{"$f":"(L571+L579+L587)*I570/100","v":0}]
["4.2.1","Does the CSP use SIEM (Security Information and Event Management) technology for analyzing the security alerts and data logs?",null,null,{"$f":"IF($D571=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E571,F571*SUM($F$571,$F$579,$F$587,)/($E$571*$F$571+$E$579*$F$579+$E$587*$F$587),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$571),0,VLOOKUP($D$571,$B$574:$C$577,2,0))","v":0},{"$f":"J571*G571","v":0},{"$f":"IF(ISBLANK(D571),0,IF(D571=\"Unknown\",100*G571,J571*G571))","v":0},{"$f":"IF(D571=B574,\"V\",IF(D571=B575,\"V\",IF(D571=B577,\"??\",IF(D571=B576,\"X\", \" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, with well documented procedures and SLAs",100]
[null,"Yes, no further information ",60]
[null,"No",0]
[null,"Unknown",0]
[]
["4.2.2","Does the CSP have an adequate incident and data breach procedure for managing and minimizing the impact of security and privacy incidents on tenants’ data. ",null,null,{"$f":"IF($D579=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E579,F579*SUM($F$571,$F$579,$F$587,)/($E$571*$F$571+$E$579*$F$579+$E$587*$F$587),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$579),0,VLOOKUP($D$579,$B$582:$C$585,2,0))","v":0},{"$f":"J579*G579","v":0},{"$f":"IF(ISBLANK(D579),0,IF(D579=\"Unknown\",100*G579,J579*G579))","v":0},{"$f":"IF(D579=B582,\"V\",IF(D579=B583,\"V\",IF(D579=B585,\"??\",IF(D579=B584,\"X\", \" \"))))","v":" "}]
[]
[null,"Score specification"]
[null,"Yes, contractually defined",100]
[null,"Yes, only documented",75]
[null,"No",0]
[null,"Unknown",0]
[]
["4.2.3","Does the CSP have adequate security policies and procedures regarding CSP employee security?",null,null,{"$f":"IF($D587=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E587,F587*SUM($F$571,$F$579,$F$587,)/($E$571*$F$571+$E$579*$F$579+$E$587*$F$587),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$587),0,VLOOKUP($D$587,$B$593:$C$595,2,0))","v":0},{"$f":"J587*G587","v":0},{"$f":"IF(ISBLANK(D587),0,IF(D587=\"Unknown\",100*G587,J587*G587))","v":0},{"$f":"IF(D587=B593,\"V\",IF(D587=B595,\"??\",IF(D587=B594,\"X\", \" \")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"E.g. acceptable user policy, security awareness program, disciplinary process."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[]
["4.3","Vulnerability management",null,null,{"$f":"IF(AND($D$598=\"N/A\",$D$609=\"N/A\",$D$619=\"N/A\",$D$629=\"N/A\"),0,1)","v":1},{"$f":"(F598+F609+F619+F629)","v":1},{"$f":"(G598+G609+G619+G629)","v":1},0.33,{"$f":"IF(E597,H597*SUM($H$514,$H$570,$H$597)/($E$514*$H$514+$E$570*$H$570+$E$597*$H$597),0)","v":0.33},null,{"$f":"(K598+K609+K619+K629)*I597/100","v":0},{"$f":"(L598+L609)*I597/100","v":0}]
["4.3.1","Is there a documented (and, hence, transparent) vulnerability management process implemented in the cloud service?",null,null,{"$f":"IF($D598=\"N/A\",0,1)","v":1},0.4,{"$f":"IF(E598,F598*SUM($F$598,$F$609,F$619,F$629)/($E$598*$F$598+$E$609*$F$609+$E$619*$F$619+$E$629*$F$629),0)","v":0.4},null,null,{"$f":"IF(ISBLANK($D$598),0,VLOOKUP($D$598,$B$604:$C$607,2,0))","v":0},{"$f":"J598*G598","v":0},{"$f":"IF(ISBLANK(D598),0,IF(D598=\"Unknown\",100*G598,J598*G598))","v":0},{"$f":"IF(D598=B604,\"V\",IF(D598=B605,\"V\",IF(D598=B607,\"??\",IF(D598=B606,\"X\", \" \"))))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"Vulnerabillity management is not limited to software (patching) but also applies on hardware."]
[]
[null,"Score specification"]
[null,"Yes, both hardware en software",100]
[null,"Yes, software only",90]
[null,"No",0]
[null,"Unknown",0]
[]
["4.3.2","Does the CSP test patches in acceptance environments prior to deployment?",null,null,{"$f":"IF($D$609=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E609,F609*SUM($F$598,$F$609,F$619,F$629)/($E$598*$F$598+$E$609*$F$609+$E$619*$F$619+$E$629*$F$629),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$609),0,VLOOKUP($D$609,$B$615:$C$617,2,0))","v":0},{"$f":"J609*G609","v":0},{"$f":"IF(ISBLANK(D609),0,IF(D609=\"Unknown\",100*G609,J609*G609))","v":0},{"$f":"IF(D609=B615,\"V\",IF(D609=B617,\"??\",IF(D609=B616,\"X\",\" \")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question depends on the cloud service model: N/A for IaaS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[]
["4.3.3","Are tools to prevent, detect and mitigate viruses and malwares at server stations available?",null,null,{"$f":"IF($D$619=\"N/A\",0,1)","v":1},0.2,{"$f":"IF(E619,F619*SUM($F$598,$F$609,F$619,F$629)/($E$598*$F$598+$E$609*$F$609+$E$619*$F$619+$E$629*$F$629),0)","v":0.2},null,null,{"$f":"IF(ISBLANK($D$619),0,VLOOKUP($D$619,$B$625:$C$627,2,0))","v":0},{"$f":"J619*G619","v":0},{"$f":"IF(ISBLANK(D619),0,IF(D619=\"Unknown\",100*G619,J619*G619))","v":0},{"$f":"IF(D619=B625,\"V\",IF(D619=B627,\"??\",IF(D619=B626,\"X\",\" \")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The answer to this question depends on the cloud service model: N/A for IaaS."]
[]
[null,"Score specification"]
[null,"Yes",100]
[null,"No",0]
[null,"Unknown",0]
[]
["4.3.4","Is hardening process performed on the server stations?",null,null,{"$f":"IF($D$629=\"N/A\",0,1)","v":1},0.2,0.2,null,null,{"$f":"IF(ISBLANK($D$629),0,VLOOKUP($D$629,$B$635:$C$640,2,0))","v":0},{"$f":"J629*G629","v":0},{"$f":"IF(ISBLANK(D629),0,IF(D629=\"Unknown\",100*G629,J629*G629))","v":0},{"$f":"IF(D629=B635,\"X\",IF(D629=B640,\"??\",IF(D629=\"\",\" \",\"V\")))","v":" "}]
[]
[null,"Explanations / Examples"]
[null,"The process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically includes changing default passwords, the removal of unnecessary software, unnecessary usernames or logins, and the disabling or removal of unnecessary services."]
[]
[null,"Score specification"]
[null,"No",0]
[null,"Yes, Optimized",100]
[null,"Yes, Managed",80]
[null,"Yes, Documentend",60]
[null,"Yes,  ",30]
[null,"Unknown",0]

{"sheet":"Overview","index":4,"n_rows":8,"n_cols":10,"rows_kept":8,"cut":false,"hidden":false,"merged":[[2,7,2,9],[0,1,0,12]]}
[null,{"$f":"CONCATENATE(\"Score overview of \",Information!C3)","v":"Score overview of "}]
[]
[null,null,null,null,null,null,null,"Indicative cloud policy compliance outlook"]
[null,null,"Minimal weighted score","Maximal weighted score",null,null,null,"Does comply","May comply","Does not comply"]
[1,"Governance",{"$f":"Assessment!K5","v":0},{"$f":"Assessment!L5","v":0},null,null,"Governance",{"$f":"COUNTIF(Assessment!$M$5:$M$217,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$217,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$217,\"X\")","v":0}]
[1,"IAM",{"$f":"Assessment!K218","v":0},{"$f":"Assessment!L218","v":0},null,null,"IAM",{"$f":"COUNTIF(Assessment!$M$218:$M$318,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$218:$M$318,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$218:$M$318,\"X\")","v":0}]
[1,"IT Security",{"$f":"Assessment!K319","v":0},{"$f":"Assessment!L319","v":0},null,null,"IT Security",{"$f":"COUNTIF(Assessment!$M$319:$M$512,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$319:$M$512,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$319:$M$512,\"X\")","v":0}]
[1,"Operational Security",{"$f":"Assessment!K513","v":0},{"$f":"Assessment!L513","v":0},null,null,"Operational Security",{"$f":"COUNTIF(Assessment!$M$513:$M$618,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$513:$M$618,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$513:$M$618,\"X\")","v":0}]

{"sheet":"TempResults","index":5,"n_rows":6,"n_cols":10,"rows_kept":6,"cut":false,"hidden":true,"merged":[[0,3,0,5],[0,6,0,8]]}
[null,null,null,"Compliance with cloud policy (not depending on data type)",null,null,"Compliance with cloud policy (depending on data type)"]
[null,"Minimal weighted score","Maximal weighted score","Does comply","May comply","Does not comply","Does comply","May comply","Does not comply","Name of the cloud service"]
["Governance",{"$f":"Assessment!K5","v":0},{"$f":"Assessment!L5","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$217,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$217,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$5:$M$217,\"X\")","v":0},{"$f":"D3","v":0},0,0,{"$f":"Information!C3","v":0}]
["IAM",{"$f":"Assessment!K218","v":0},{"$f":"Assessment!L218","v":0},{"$f":"COUNTIF(Assessment!$M$218:$M$318,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$218:$M$318,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$218:$M$318,\"X\")","v":0},0,0,0]
["IT Security",{"$f":"Assessment!K319","v":0},{"$f":"Assessment!L319","v":0},{"$f":"COUNTIF(Assessment!$M$319:$M$512,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$319:$M$512,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$319:$M$512,\"X\")","v":0},{"$f":"COUNTIF(Assessment!#REF!,\"V\")+D5","v":{"$error":"#REF!"}},{"$f":"COUNTIF(Assessment!#REF!,\"??\")+E5","v":{"$error":"#REF!"}},{"$f":"COUNTIF(Assessment!#REF!,\"X\")+F5","v":{"$error":"#REF!"}}]
["Operational Security",{"$f":"Assessment!K513","v":0},{"$f":"Assessment!L513","v":0},{"$f":"COUNTIF(Assessment!$M$513:$M$618,\"V\")","v":0},{"$f":"COUNTIF(Assessment!$M$513:$M$618,\"??\")","v":0},{"$f":"COUNTIF(Assessment!$M$513:$M$618,\"X\")","v":0},{"$f":"D6","v":0},{"$f":"E6","v":0},{"$f":"F6","v":0}]