I have a Relational Database (DB) that is hosted by a cloud provider in my asset registry to be used for ISO27001 certification.This implies everything is maintained by the cloud provider, e.g. networking, patching, scaling, except stuff I would like to apply such as encryption, access controls etc. I have access to the DB via an API and I handle it as a service only.

When I perform risk assessment on an item like this, do I list all possible DB related threats and vulnerabilities and say they are covered by SLA or I just mention the ones that I have the responsibility for?

  • What risk assessment methodology are you using? I tend to use simple spreadsheets and usually only deal with threat categories, not individual threats. For outsourced services, I do include all the threat categories, with the control something like "Supplier provides protection"
    – paj28
    Commented Oct 27, 2016 at 16:37
  • i m using the asset-threat-vulnerability-control methodology as suggested by ISO 27001. Commented Oct 27, 2016 at 21:34

1 Answer 1


It would be helpful to list the database related threats and vulnerabilities. This way you can be sure that they are actually covered by SLA. This could be cross-audited under A.15 supplier relationships & A.9 access control. The risk treatment may well be handled under SLA but you are still the risk owner unless that has been very clearly transferred to (& accepted by) the hosting partner.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .