|
Computer Audit And Testing Services - Data Security Testing Services. Hus Group (Hereinafter Also The Customer Or Procurement Entity) Requests Offers For Information Security Testing Services In Accordance With The Conditions Of This Request For Tenders And Its Appendices. Data Security Testing Generally Uses A Quantitative Data Security Model. The Testing Follows Necessary And Generally Accepted Frameworks And Standards Such As Cc (Common Criteria For Information Technology Security Evaluation), Owasp (Open Web Application Security Project) Including Owasp Asvs And Owasp Llm, Wasc (Web Application Security Consortium), Nist And, Where Applicable, Iso Iec 27001 And Iso Iec 27002 And Eal (Evaluation Assurance Level) Specifications. Testing Can Include Defining The Level Of Information Security Requirements, Reviewing The Information Security Architecture And Centralized Controls At The Process And Information System Level. Based On The Testing, Clear And Prioritized Change Proposals Are Prepared To Correct The Discovered Information Security Deficiencies. In Addition To Information Systems, Information Security Testing Targets Interfaces, Integrations, Cloud Environments (Iaas, Paas, Saas), Identity And Access Management Solutions (Iam), Mobile Applications And, If Necessary, Information System Components Related To Medical Devices. The Content Of Information Security Testing Can Be, For Example: - Implementation Checks, Information Security Assessments And Quantum Readiness Assessments - Repeated Vulnerability Scans And Vulnerability Management - Penetration Testing (Including Web, Mobile, Infrastructure And Api Testing And, If Necessary, Red Team Exercises) - Simulation Of Denial Of Service Attacks In The Agreed Scope - Checks Of Configurations And Information Security Settings (Baseline Compliance) - Software Components And Data Security Assessment Of Dependencies (Supply Chain) - Planning, Implementation, Management And Maintenance Tasks Of Testing For Artificial Intelligence And Llm Solutions, Testing Covers In Particular: - Risks Related To The Manipulation Of Inputs And Prompts (Prompt Injection) - Data Leakage Risks And The Disclosure Of Information Through Models - Risks Of Misuse And Bypassing Of Models - Security Of User Rights, Interfaces And Integrations - Connections Of Artificial Intelligence Systems To Other Information Systems Testing Are Carried Out In Accordance With The Procedures Agreed With The Customer. These Include, Among Other Things, The Limitations Of Testing, Scheduling, Approved Testing Methods, Special Arrangements For Tests Targeting The Production Environment, Management Of Disruptions, And Secure Data Processing During Testing. In Addition, The Experts Participating In The Production Of The Service Are Agreed Upon. The Supplier Is Responsible For The Documentation, Which Includes At Least: - Test Plan - Interim Reports During Testing - Test Results And Observation-Specific Descriptions - Conclusions Of The Final Report. The Reporting Must Include A Clear Risk Classification Of Findings (Critical, High, Medium, Low), Impact Assessment And Concrete Recommendations For Correction. The Report Must Also Include A Summary And Tek
|
