I have a Relational Database (DB) that is hosted by a cloud provider in my asset registry to be used for ISO27001 certification.This implies everything is maintained by the cloud provider, e.g. networking, patching, scaling, except stuff I would like to apply such as encryption, access controls etc. I have access to the DB via an API and I handle it as a service only.

When I perform risk assessment on an item like this, do I list all possible DB related threats and vulnerabilities and say they are covered by SLA or I just mention the ones that I have the responsibility for?

  • What risk assessment methodology are you using? I tend to use simple spreadsheets and usually only deal with threat categories, not individual threats. For outsourced services, I do include all the threat categories, with the control something like "Supplier provides protection" – paj28 Oct 27 '16 at 16:37
  • i m using the asset-threat-vulnerability-control methodology as suggested by ISO 27001. – Hashed_Then_Encrypted Oct 27 '16 at 21:34

It would be helpful to list the database related threats and vulnerabilities. This way you can be sure that they are actually covered by SLA. This could be cross-audited under A.15 supplier relationships & A.9 access control. The risk treatment may well be handled under SLA but you are still the risk owner unless that has been very clearly transferred to (& accepted by) the hosting partner.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.