Central Bank of Jordan Cloud Computing Guideline (2018) 2.7.1: Protect data through physical security, classification, segregation, backup ownership and loss mitigation

What does 2.7.1 require?

The company makes sure the provider's data centres meet physical protection requirements; adopts a data classification by sensitivity, which remains its own responsibility and is reviewed periodically; identifies the data to be moved to the cloud according to that classification, weighing the risk of placing sensitive data on public or hybrid cloud; obtains evidence that its data is separated from that of other cloud consumers and of the provider; identifies who is responsible for backups and the backup mechanism and locations; takes adequate steps against the security risks of transferring data to the cloud; and identifies the nature and scope of data loss risk and mitigates it by spreading data and applications across locations and following business continuity and disaster recovery best practice.