GV.PO-P4: Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners)

Include provisions limiting changes directly impacting CSCs owned environments/tenants to explicitly authorized requests within service level agreements between CSPs and CSCs.

CSPs must provide the capability for CSCs to manage their own data encryption keys.

Define, implement and evaluate processes, procedures and technical measures for the transfer and sub-processing of personal data within the service supply chain, according to any applicable laws and regulations.

Define and document roles and responsibilities for planning, implementing, operating, assessing, and improving governance programs.

Agreements must include provisions specifying CSCs access to data upon contract termination and will include: Data format Length of time the data will be stored Scope of the data retained and made available to the CSCs Data deletion policy

Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.

Apply, document, implement and manage the SSRM throughout the supply chain for the cloud service offering.

Provide SSRM Guidance to the CSC detailing information about the SSRM applicability throughout the supply chain.

Delineate the shared ownership and applicability of all CSA CCM controls according to the SSRM for the cloud service offering.

CSPs periodically review risk factors associated with all organizations within their supply chain.

Service agreements between CSPs and CSCs (tenants) must incorporate at least the following mutually-agreed upon provisions and/or terms: Scope, characteristics and location of business relationship and services offered Information security requirements (including SSRM) Change management process Logging and monitoring capability Incident management and communication procedures Right to audit and third party assessment Service termination Interoperability…

Review supply chain agreements between CSPs and CSCs at least annually.

Implement policies requiring all CSPs throughout the supply chain to comply with information security, confidentiality, access control, privacy, audit, personnel policy and service level requirements and standards.

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.