Control Criteria of ISMAP (August 2024)

the assets this control asks the inventory to single out are the customer's data and the data the service derives from it; the inventory this cluster keeps holds the images that ran and what they are made of, which is the software rather than what it processed, and answering a data-identification control from a software inventory would be the over-claim this package exists to refuse

ownership is a named person or team made answerable for an asset, recorded in the provider's own asset register; a cluster records which images ran and what is inside them, and nothing in those records says who is accountable for one

the policy this control asks for governs who may reach the provider's information and information processing facilities, and it is written and reviewed in the provider's own governance; the policy this cluster enforces decides which images may run, which is a different subject under the same word

this control is a communication the provider makes to its own customers about its own service; a cluster records the changes it admitted and under which policy, and nothing in those records says whether anybody was told

this control asks the provider to give its own customers a way to obtain logs of their use of the service; the log this control keeps is of the provider's cluster and is read by the provider, which is the opposite direction to the one the control points in

who is answerable for monitoring, assessing and remediating a vulnerability is an assignment the provider makes and records in its own governance; a cluster shows the work being done and never who was supposed to do it

these rules are established inside the development organisation and applied while software is being written; this cluster meets the result as a built image and can say what is inside it and who signed it, not what rule the people who made it were working to

what the provider publishes about how it develops software, and what its disclosure policy holds back, are decisions taken outside this cluster and recorded nowhere in it

the changes this control governs are made inside the development lifecycle, before anything is built; the change record this cluster keeps is of images arriving at a running system and is reported under 12.1.2, where these criteria ask for it

this control tests the security functionality a system is being built with, while it is being built; scanning a finished image measures which known vulnerabilities its components carry, which is a different measurement of a different thing and not a substitute for it

this control is an agreement reached with a supplier and written down; a cluster sees the software a supplier shipped, not the terms on which it was shipped

this control is about which law could reach the customer's data and which contract says so; it is answered by the provider's legal assessment of its contractors and its contracts, and an admission decision observes neither

this document is evidence such a review reads, not the review itself; the independence the control asks for is a property of who performs it, and a control cannot review itself. Under ISMAP the review is performed by an assessor from the registered assessor list, over the assessment period the provider states

the whole of Attached table 1 is what a governing body does: evaluating whether security objectives are aligned to the business, directing managers, monitoring what they report back, communicating with stakeholders and commissioning assurance. None of it is a property of a cluster, and a provider states it from its own board records

Attached table 2 is the management system — scope, policy, risk assessment and treatment, competence, documented information, internal assessment, management review, corrective action, and the risk communication with cloud service customers that Chapter 4.9 adds. It is assessed against the provider's own records of running it, and a cluster is one of the things it directs rather than any part of it

screening before employment, the terms in a contract, awareness training, the disciplinary process and the responsibilities that survive a departure are all statements about people; an admission decision taken on an image observes none of them

perimeters, entry controls, cabling, equipment siting and secure disposal are properties of the data centres the provider runs or buys; a webhook inside a cluster sees none of the building it is running in

network segregation, network service agreements and the consistency between a virtual network and the physical one beneath it are configured in the network and in the platform under the nodes; this control decides which images may run and never sees a packet