Central Bank of Jordan Cloud Computing Guideline (2018) 2.7.4: Define incident handling and run periodic penetration tests and vulnerability scans with the provider

What does 2.7.4 require?

The company defines the procedures for handling violations and other events that harm the cloud services; periodically conducts penetration tests of the systems behind the assigned services, especially operating systems in the provider's virtual environment, in cooperation with the provider, given the exposure that comes from consumers sharing physical components; and periodically runs vulnerability scans on the systems and software behind the assigned services, remediating gaps in coordination with the provider before they can be exploited.