Security and TOM Annex
Contractual description of the technical and organisational measures applicable to the agreed scope.
This Annex applies only where an approved contract document expressly incorporates it by document ID, version, and applicable Service scope.
CUTO is responsible for the measures allocated to the Service in this Annex. The Customer is responsible for its users, roles, endpoints, inputs, configurations, and other actions to the extent under its control.
CUTO assigns security responsibilities, decision authority, escalation paths, and evidence ownership for the covered Service scope and maintains the governing requirements under version control.
Persons with authorised access are bound by appropriate confidentiality obligations and receive role-relevant security requirements.
Access follows defined roles and organisation or project boundaries and is limited to the scope required for the relevant task.
CUTO assigns the granting, change, review, and revocation of access rights to authorised roles and documented triggers.
Single sign-on connects CUTO to the organisation’s central identity provider. The supported connection depends on the agreed service scope.
CUTO protects data in transit and at rest according to the scope defined for the relevant data path. Exceptions and transitions are documented under control.
For cryptographic keys, ownership, permitted access, lifecycle, protection, and replacement are defined for the relevant scope of use.
CUTO records security-relevant activity for the approved event scope with actor, time, action, and result and protects access to and integrity of those records.
Technical signals and relevant records feed into the detection, assessment, and handling of security-relevant events.
Security requirements are considered in planning, development, testing, release, and maintenance of the covered Service scope.
Changes to the covered Service scope are assessed, tested, approved, traceably released, and reversed where necessary under defined responsibilities.
CUTO identifies, assesses, prioritises, and addresses known vulnerabilities in the covered Service scope on a risk basis and documents the material decisions.
CUTO backs up data under procedures documented for the covered Service scope and protects backups according to their data path and lifecycle.
CUTO uses documented recovery objectives for the relevant Service scope. Binding values exist only to the extent stated in the applicable and approved service documents.
Recovery and continuity procedures are planned, exercised, and documented with results and follow-up actions for the approved scope.
CUTO detects, assesses, prioritises, contains, and handles security-relevant events through defined roles, escalation paths, and communication processes.
Customer communications concerning security events follow the approved incident-routing matrix. For personal data breaches affecting Customer Personal Data, the expressly incorporated DPA provisions additionally apply.
Security-relevant service providers are selected and governed according to the risk, contractual scope, data access, and evidence needs defined for their engagement.
Physical safeguards are defined on a risk basis for the relevant operating and provider environments and assessed through approved evidence or contractual controls.
Retention, export, return, deletion, backup expiry, and legal exceptions follow the approved data-lifecycle schedule for the relevant data object.
CUTO maintains controlled evidence for the covered measure scope. Material changes are assessed, versioned, and communicated under the applicable contract and document process.