Zweck: Detail-Security-Checks zur Validierung der Accenture CDP Web Application Standards auf Code-/Architektur-Ebene.
Checkliste (7 Checks)
Phase: Solution Plan
General
Verify is there any privacy or other legislation restricting the transmission and storage of data ⚪N/A — CapaKraken ist On-Prem Docker-Deployment, keine Cloud-Transmission.
Deployment and enforcement of proper data protection standards as per the industry standards, including country wide Legal / Legislation policies. (Such as - Industry Data Protection Standard BS 10012:2009 or PCI DSS, U.K. Data Protection Act (DPA) 1984, India IT Act 2000). ⚪N/A — On-Prem, keine Cloud-Services.
Ensure the SLAs pertaining to cloud services are properly identified and documented. Also, ensure the cloud service provider has adequate measures for Business continuity/resiliency as per the standards such as BS25999. ⚪N/A — Keine Cloud-Services gebucht.
Verify Policy, standards, and guidelines of Cloud service provider, by considering the Infranstructure Securty Standard (Such as Secure Hardening and configuration baselines based on the industry best practice / secure architecture between application, system and network / Role based Administrative controls should be incorporated / Policy and procedure for critical security patches and updates must be applied / Periodic Risk and Threat assessment policy to avoid production breakdown due to security threats). ⚪N/A — Kein Cloud-Provider im Einsatz.
Verify if controls are in place to manage externally sourced and internally sourced attacks, including distributed denial of service, including physical security is managed and monitored from internal and external attack ⚪N/A — On-Prem-Deployment. (Grund-Schutz: nginx + rate-limit, aber kein Cloud-DDoS-Schutz nötig.)
Is there any Data recovery guarantee considered at initial stage, since organisation don’t have access to the physical and logical cloud infra? ⚪N/A — Backup-Strategie läuft über lokales Docker Volume (separates Thema).
In case of multiple cloud services are engaged, whether user identities and access controls are protected and considered through out Secure SDLC? ⚪N/A — Kein Cloud-Service-Mesh.
## Quelle
- **xlsx:** `samples/CDP/checklists/cloud.xlsx`
- **Parent-Control:** #29
- **Epic:** #1
- **Zweck:** Detail-Security-Checks zur Validierung der Accenture CDP Web Application Standards auf Code-/Architektur-Ebene.
## Checkliste (7 Checks)
### Phase: Solution Plan
#### General
- [x] Verify is there any privacy or other legislation restricting the transmission and storage of data
⚪ ***N/A** — CapaKraken ist On-Prem Docker-Deployment, keine Cloud-Transmission.*
- [x] Deployment and enforcement of proper data protection standards as per the industry standards, including country wide Legal / Legislation policies. (Such as - Industry Data Protection Standard BS 10012:2009 or PCI DSS, U.K. Data Protection Act (DPA) 1984, India IT Act 2000).
⚪ ***N/A** — On-Prem, keine Cloud-Services.*
- [x] Ensure the SLAs pertaining to cloud services are properly identified and documented. Also, ensure the cloud service provider has adequate measures for Business continuity/resiliency as per the standards such as BS25999.
⚪ ***N/A** — Keine Cloud-Services gebucht.*
- [x] Verify Policy, standards, and guidelines of Cloud service provider, by considering the Infranstructure Securty Standard (Such as Secure Hardening and configuration baselines based on the industry best practice / secure architecture between application, system and network / Role based Administrative controls should be incorporated / Policy and procedure for critical security patches and updates must be applied / Periodic Risk and Threat assessment policy to avoid production breakdown due to security threats).
⚪ ***N/A** — Kein Cloud-Provider im Einsatz.*
- [x] Verify if controls are in place to manage externally sourced and internally sourced attacks, including distributed denial of service, including physical security is managed and monitored from internal and external attack
⚪ ***N/A** — On-Prem-Deployment. (Grund-Schutz: nginx + rate-limit, aber kein Cloud-DDoS-Schutz nötig.)*
- [x] Is there any Data recovery guarantee considered at initial stage, since organisation don’t have access to the physical and logical cloud infra?
⚪ ***N/A** — Backup-Strategie läuft über lokales Docker Volume (separates Thema).*
- [x] In case of multiple cloud services are engaged, whether user identities and access controls are protected and considered through out Secure SDLC?
⚪ ***N/A** — Kein Cloud-Service-Mesh.*
Laut docs/acn-standards-applicability.md ist der SaaS/PaaS Cloud Computing Security Standard für CapaKraken aktuell nicht relevant (On-Prem Docker-Deployment). Alle 7 Checks dieser Checkliste sind auf Cloud-Services bezogen und damit nicht anwendbar.
Aktion: Ticket wird geschlossen. Bei zukünftiger Cloud-Migration neu öffnen und Checkliste abarbeiten.
Parent-Control #29 bleibt offen mit analogem N/A-Vermerk bis zur Cloud-Entscheidung.
## Empfehlung: N/A schließen
Laut [`docs/acn-standards-applicability.md`](../blob/main/docs/acn-standards-applicability.md) ist der **SaaS/PaaS Cloud Computing Security Standard** für CapaKraken aktuell **nicht relevant** (On-Prem Docker-Deployment). Alle 7 Checks dieser Checkliste sind auf Cloud-Services bezogen und damit nicht anwendbar.
**Aktion:** Ticket wird geschlossen. Bei zukünftiger Cloud-Migration neu öffnen und Checkliste abarbeiten.
Parent-Control #29 bleibt offen mit analogem N/A-Vermerk bis zur Cloud-Entscheidung.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Quelle
samples/CDP/checklists/cloud.xlsxCheckliste (7 Checks)
Phase: Solution Plan
General
⚪ N/A — CapaKraken ist On-Prem Docker-Deployment, keine Cloud-Transmission.
⚪ N/A — On-Prem, keine Cloud-Services.
⚪ N/A — Keine Cloud-Services gebucht.
⚪ N/A — Kein Cloud-Provider im Einsatz.
⚪ N/A — On-Prem-Deployment. (Grund-Schutz: nginx + rate-limit, aber kein Cloud-DDoS-Schutz nötig.)
⚪ N/A — Backup-Strategie läuft über lokales Docker Volume (separates Thema).
⚪ N/A — Kein Cloud-Service-Mesh.
Review-Ergebnis
Detail-Analyse aller 7 Checks aus
samples/CDP/checklists/cloud.xlsxgegen CapaKraken-Code unddocs/acn-security-compliance-status.md.Empfehlung:
Alle Checks abgedeckt. Ticket kann nach Owner-Review geschlossen werden.
Empfehlung: N/A schließen
Laut
docs/acn-standards-applicability.mdist der SaaS/PaaS Cloud Computing Security Standard für CapaKraken aktuell nicht relevant (On-Prem Docker-Deployment). Alle 7 Checks dieser Checkliste sind auf Cloud-Services bezogen und damit nicht anwendbar.Aktion: Ticket wird geschlossen. Bei zukünftiger Cloud-Migration neu öffnen und Checkliste abarbeiten.
Parent-Control #29 bleibt offen mit analogem N/A-Vermerk bis zur Cloud-Entscheidung.