サーバが仮想化されている場合、Hypervisor層の管理者による不正なデータ持ち出しができない、又は発見できる仕組みになっているか
データへのアクセス権の設定情報にアクセスできる管理者は限定され、外部に漏えいしないよう対策がとられているか
データにアクセスできるベンダの管理者権限は定期的に棚卸されているか
委託するデータに、個人情報・営業機密情報等の重要情報が含まれているなど、NDAの締結が必要な場合、以下内容の十分性を確認する
-> データの対象範囲、期間、禁止事項、賠償責任、等
Rating
54
Translation / English
- Posted at 10 Apr 2013 at 12:41
We confirm the sufficiency of the content as follows when the conclusion of NDA is necessary: Wether it is the system in which carrying out of the unjust data by custodians of the Hypervisor group is impossible or can be discovered when the server is virtualized,
whether the custodians who can access the setting information of the access right to data are limited, and some measures are taken in order that it won't leak outside,
whether the inventory of the administrator rights of the vendor who can access data is taken regularly,
whether the critical informations such as private information, the business classified information are included in data to consign you, and so on.
->The range targeted for data, the period, the prohibited matter, the compensation responsibility, etc.
whether the custodians who can access the setting information of the access right to data are limited, and some measures are taken in order that it won't leak outside,
whether the inventory of the administrator rights of the vendor who can access data is taken regularly,
whether the critical informations such as private information, the business classified information are included in data to consign you, and so on.
->The range targeted for data, the period, the prohibited matter, the compensation responsibility, etc.
Rating
54
Translation / English
- Posted at 10 Apr 2013 at 15:41
When the server is virtualized, can the data be taken out with Hypervisor layer administrator or if such attempt can be discovered.
Is the access privilege to access the configuration information for data access rights limited to a specific administrative users, and is it protected so that it will not leak to the outside.
Is the vendor's administrative rights which allows the user to access the data periodically updated
If the data to be provided includes important information such as personal information or commercially confidential information which requires the signed NDA, then check if the following is sufficiently met --> Scope of data, period, prohibited matter, liability, etc.
Is the access privilege to access the configuration information for data access rights limited to a specific administrative users, and is it protected so that it will not leak to the outside.
Is the vendor's administrative rights which allows the user to access the data periodically updated
If the data to be provided includes important information such as personal information or commercially confidential information which requires the signed NDA, then check if the following is sufficiently met --> Scope of data, period, prohibited matter, liability, etc.
★★★★☆ 4.0/1
