Statement of Work (SOW)

Service Overview

Customers have to use professional capabilities to ensure data security, due to stricter laws and regulations, increasing data leakage, and the urgent need for professional security of cloud services. Moreover, cloud security capabilities are becoming increasingly intricate, posing challenges for enterprise users to properly configure security policies.

To address these issues, Huawei Cloud launches Storage Security Optimization Service (SSOS). It evaluates customers' storage service statuses, provides key capabilities to identify and handle data security risks, and helps customers reduce costs of handling audits as well as minimize the risks of business suspension, criminal punishment, economic loss, and reputational loss caused by data leakage.

Service Content

• Storage Security Diagnosis

  Specifications	Content	Application Scenario
  Storage Security Diagnosis - Basic Package	Huawei Cloud evaluates customers' cloud storage service content, summarizes the customers' cloud storage services from static data assets and dynamic access behaviors, and delivers survey reports to them. Huawei Cloud evaluates the customers' cloud storage service systems based on Data Security Capability Maturity Mode (DSMM) and the survey of their service data. The evaluation includes analyzing the customers' access control policies, transmission security, storage security, and data compliance processing. By analyzing the customers' cloud service data security capabilities, potential risks are identified and reported to the customers.	These packages are intended for medium- and large-sized enterprises with complex service data usage. They help customers evaluate security capability maturity, identify potential risks, and handle related security reviews.
  Storage Security Diagnosis - Incremental Package

• Storage Security Planning and Design

  Specifications	Content	Application Scenario
  Storage Security Planning and Design - Basic Package	Huawei Cloud provides customers with solutions for complex service scenarios, including account classification, permission policy configuration, data encryption, data compliance processing, data retention, data deletion, backup, disaster recovery, and ransomware protection. Huawei Cloud designs optimization and improvement solutions to minimize data security risks identified in Storage Security Diagnosis.	These packages are intended for customers who have complex service data usage and have purchased Storage Security Diagnosis packages. They help customers optimize system design and recommend configurations based on the identified risks.
  Storage Security Planning and Design - Incremental Package
  Storage Security Planning and Design - Technical Support Package	Huawei Cloud guides customers to complete complex policy configuration and implement best security practices such as storage data transmission, storage, and deletion based on the solutions provided by Storage Security Planning and Design.	This package is intended for customers who have complex service data usage and have purchased Storage Security Diagnosis and Storage Security Planning and Design packages. It helps customers implement the solution.

Prerequisites

• The customer has migrated data to the cloud and is using storage products.
• The customer is highly cooperative. The owner takes the lead and assigns personnel to make surveys, analysis, and plans.
• Before implementing the service and providing a data security diagnosis report, Huawei Cloud must first obtain authorization from the customer to learn about the customer's data access behaviors.
• Both parties shall agree on the service objectives and the customer shall pay for the service.

Applicable Scope

1. Service Content Covered

   During the entire process, Huawei Cloud provides the following services:

   • Storage Security Diagnosis: Huawei Cloud evaluates customers' cloud storage services by conducting surveys on their static data assets and dynamic access behaviors. The survey reports are delivered to the customers. In addition, Huawei Cloud evaluates the customers' cloud storage service systems based on DSMM and the survey of their service data. The evaluation includes analyzing the customers' access control policies, transmission security, storage security, and data compliance processing. By analyzing the customers' cloud service data security capabilities, potential risks are identified and reported to the customers.
   • Storage Security Planning and Design: Huawei Cloud develops storage security solutions for complex service scenarios. These solutions include account classification, permission policy configuration, data encryption, data compliance processing, data retention, data deletion, backup, disaster recovery, and ransomware protection. Additionally, Huawei Cloud designs optimization and improvement solutions to help customers minimize security risks that have been diagnosed and identified.
   • Storage Security Technical Support: Huawei Cloud guides customers to implement the security optimization solutions formulated in the Storage Security Planning and Design service.
2. Service Content Not Covered

   Services implemented by customers, including but not limited to:

   Integrating different systems.

3. Service Regions

   Global

Service Process

• Storage Security Diagnosis

  Phase	Description
  Requirement survey	Clarifying service objectives: Huawei Cloud conducts surveys on customers' storage service statuses and basic requirements, aligns with the customers' data security development goals and scope, clarifies data access authorization, conducts interviews, and agrees on the service objectives with the customers. Formulating solutions: Huawei Cloud aligns detailed solutions with customers, including the service content, process, schedule, and expense, to ensure that the solutions meet the customers' requirements and are feasible.
  Diagnosis and evaluation	Evaluating static data assets: Huawei Cloud analyzes and evaluates the data assets in customers' cloud storage, including the types of stored data, existing data distribution, and encrypted data proportion. Evaluating dynamic access behaviors: Huawei Cloud analyzes customers' access patterns and behaviors to the cloud storage, including the access frequency, access IP address location, and access peak and off-peak hours. Evaluating the security of the cloud storage service systems: Huawei Cloud conducts surveys on customers' cloud storage features and evaluates the access control policies, transmission security, storage security, and data compliance processing of their systems based on DSMM and the dynamic and static models of the customers' services to identify potential security risks. Determining security risk level: Huawei Cloud analyzes potential risks based on their severity and likelihood of occurrence, determines the level of data security risk, and provides preliminary measures to minimize risks. Exporting reports: Huawei Cloud presents the items mentioned above in reports.
  Service acceptance	Customers accept the solutions. Huawei Cloud hands over related documents and delivers the data security diagnosis report with interpretation.

• Storage Security Planning and Design

  Phase	Description
  Requirement survey	Clarifying service objectives: Huawei Cloud aligns with customers' data security development goals and project budgets, designs the application scope, conducts interviews, and agrees on the service objectives with customers. Formulating solutions: Huawei Cloud aligns detailed solutions with customers, including the service content, process, schedule, and expense, to ensure that the solutions meet the customers' requirements and are feasible.
  Solution design	Evaluating customers' cloud and on-premises environments: Based on the security diagnosis report, Huawei Cloud conducts surveys on customers' on-premises infrastructure and personnel organization for proper security design. Formulating security planning and design solutions: Huawei Cloud creates security planning and design solutions based on customers' requirements, their existing environments and resources, industry standards, and Huawei Cloud best practices. These solutions comprise security objectives, policies, and measures, as well as security-related feature selection and configuration guidance and are designed to enhance the customers' cloud storage service security capabilities. Communication and confirmation: Huawei Cloud communicates with customers about the solutions, explains the key points and contents of the solutions, and ensures that the customers understand and accept the solutions. If necessary, Huawei Cloud will adjust and modify the solutions until a consensus is reach.
  Service acceptance	Customers accept the solutions. Huawei Cloud hands over related documents and guides customers to implement the solutions.

Service Deliverables

• Storage Security Diagnosis

  Specifications	Deliverable	Acceptance Report
  Storage Security Diagnosis - Basic Package	Huawei Cloud Storage Security Diagnosis Report	Huawei Cloud Storage Security Optimization Service Acceptance Report for XX Project
  Storage Security Diagnosis - Incremental Package

• Storage Security Planning and Design

  Specifications	Deliverable	Acceptance Report
  Storage Security Planning and Design - Basic Package	Huawei Cloud Storage Security Planning and Design Proposal	Huawei Cloud Storage Security Optimization Service Acceptance Report for XX Project
  Storage Security Planning and Design - Incremental Package
  Storage Security Planning and Design - Technical Support Package	None	None

Responsibility Division

1. Huawei Cloud and Customer
   • Negotiate and confirm specific requirements and objectives.
   • Negotiate and confirm project management plans.
   • Negotiate, confirm, and review solutions.
   • Sign contracts.
2. Huawei Cloud
   • Receives customer requirements and designates experts to help implement and guarantee the service delivery onsite or remotely.
   • Develops a service plan and quotation based on the service items for customers to review and confirm.
   • Provides services based on the service plan and creates the deliverables needed.
   • Provides the list of deliverables based on the selected service items after services are all complete.
   • Specifies a project owner and notifies customers of any personnel changes three working days in advance.
   • Uses the authorized data only for this service and not for any other purposes.
3. Customer
   • Assigns a project owner to assist Huawei Cloud in implementing the service. The project owner is responsible for arrangement and coordination between the two parties, and reviewing and accepting the services provided by Huawei Cloud.
   • Assists Huawei Cloud in the requirement survey, provides accurate service requirements, and provides service system information (including but not limited to the application architecture, deployment architecture, resource quantity, and performance).
   • Provides necessary authorization to assist Huawei Cloud in reading and analyzing the service data.
4. Responsibility Matrices

   The following table provides responsibility matrix examples and can be modified as needed.

   R: responsible; S: supportive.

   • Storage Security Diagnosis

     No.	Process	Content	Huawei	Customer
     1	Requirement survey	Specify service objectives and required data authorization.	R	R
     2		Formulate solutions.	R	S
     3	Diagnosis and evaluation	Evaluate the static data assets.	R	S
     4		Evaluate the dynamic access behaviors.	R	S
     5		Evaluate the security of the cloud storage service systems.	R	S
     6		Evaluate the level of the security risk.	R	S
     7		Output and review reports.	R	R
     8	Service acceptance	Accept the solutions.	S	R
     9		Deliver the data security diagnosis report with interpretation.	R	S

   • Storage Security Planning and Design

     No.	Process	Content	Huawei	Customer
     1	Requirement survey	Specify service objectives.	R	R
     2		Formulate solutions.	R	S
     3	Solution design	Evaluate customers' cloud and on-premises service environments.	R	S
     4		Formulate the security planning and design solutions.	R	S
     5		Communicate with the other party and confirm the solutions.	R	R
     6	Service acceptance	Accept the solutions and related documents provided by Huawei Cloud.	S	R
     7		Guide customers to implement the solution.	R	S

Acceptance Criteria

• Storage Security Diagnosis

  Huawei Cloud submits standard deliverables based on service sub-items. Customers confirm the acceptance on the Huawei Cloud official website console, or signs and seals the Huawei Cloud Storage Security Optimization Service Acceptance Report for XX Project onsite as the basis for service acceptance.

• Storage Security Planning and Design
  • For the Storage Security Planning and Design packages, Huawei Cloud submits standard deliverables based on service sub-items. Customers confirm the acceptance on the Huawei Cloud official website console, or signs and seals the Huawei Cloud Storage Security Optimization Service Acceptance Report for XX Project onsite as the basis for service acceptance.
  • For the Storage Security Planning and Design - Technical Support Package, customers confirm the acceptance on the Huawei Cloud official website console, or signs and seals the Huawei Cloud Storage Security Optimization Service Acceptance Report for XX Project onsite as the basis for service acceptance.