Gaia-X Label level 1 Gaia-X L1

The Provider shall offer the ability to establish a legally binding act. This legally binding act shall be documented.

The Provider shall have an option for each legally binding act to be governed by EU/EEA/Member State law.

The Provider shall clearly identify for which providers parties the legal act is binding.

The Provider shall ensure that the legally binding act covers the entire provision of the Service Offering.

The Provider shall clearly identify in each legally binding act the applicable governing law.

The Provider shall ensure there are specific provisions regarding service interruptions and business continuity (e.g., by means of a service level agreement), Provider's bankruptcy or any other reason by which the Provider may cease to exist in law.

The Provider shall ensure there are provisions governing the rights of the parties to use the service and any Customer Data therein.

The Provider shall ensure there are provisions governing changes, regardless of their kind.

The Provider shall ensure there are provisions governing aspects regarding copyright or any other intellectual property rights.

The Provider shall declare the general location of any processing of Customer Data, allowing the Customer to determine the applicable jurisdiction and to comply with Customer's requirements in the context of its business and operational context.

The Provider shall explain how information about subcontractors and related Customer Data localization will be communicated.

The Provider shall communicate to the Customer where the applicable jurisdiction(s) of subcontractors will be.

The Provider shall include in the contract the contact details where Customer may address any queries regarding the Service Offering and the contract.

The Provider shall declare the mandatory service and resource attributes in the self-description of each Service Offering.

The Provider shall describe the Permissions, Requirements and Constraints of the Service Offering using a common Domain-Specific Language (DSL) in the self-description.

The Provider shall ensure that the Service Offering is operated by a Gaia-X participant defined by a verified credential.

The Provider shall offer the ability to establish a contract under Union or EU/EEA/Member State law and specifically addressing GDPR requirements.

The Provider shall define the roles and responsibilities of each party.

The Provider shall clearly define the technical and organizational measures in accordance with the roles and responsibilities of the parties, including an adequate level of detail.

The Provider shall be ultimately bound to instructions of the Customer.

The Provider shall clearly define how Customer may instruct, including by electronic means such as configuration tools or APIs.

The Provider shall clearly define if and to which extent third country transfer will take place.

The Provider shall clearly define if and to the extent third country transfers will take place, and by which means of Chapter V GDPR these transfers will be protected.

The Provider shall clearly define if and to which extent sub-processors will be involved.

The Provider shall clearly define if and to the extent sub-processors will be involved, and the measures that are in place regarding sub-processors management.

The Provider shall define the audit rights for the Customer.

Organization of information security: Plan, implement, maintain and continuously improve the information security framework within the organisation.

Information Security Policies: Provide a global information security policy, derived into policies and procedures regarding security requirements and to support business requirements

Risk Management: Ensure that risks related to information security are properly identified, assessed, and treated, and that the residual risk is acceptable to the service provider.

Human Resources: Ensure that employees understand their responsibilities, are aware of their responsibilities with regard to information security, and that the organisation's assets are protected in the event of changes in responsibilities or termination.

Asset Management: Identify the organisation's own assets and ensure an appropriate level of protection throughout their lifecycle.

Physical Data Center Security: Prevent unauthorised physical access and protect against theft, damage, loss and outage of operations.

Operational Security: Ensure proper and regular operation, including appropriate measures for planning and monitoring capacity, protection against malware, logging and monitoring events, and dealing with vulnerabilities, malfunctions and failures.

Identity, Authentication and access control management: Limit access to information and information processing facilities.

Cryptography and Key management: Ensure appropriate and effective use of cryptography to protect the confidentiality, authenticity or integrity of information.

Network Security: Ensure the protection of information in networks and the corresponding information processing systems.

Portability and Interoperability: The CSP shall provide a means by which a customer can obtain their stored customer data, and provide documentation on how (where appropriate, through documented API’s) the CSC can obtain the stored data at the end of the contractual relationship and shall document how the data will be securely deleted from the Cloud Service Provider in what timeframe.

Change and Configuration Management: Ensure that changes and configuration actions to information systems guarantee the security of the delivered service.

Development of Information systems: Ensure information security in the development cycle of information systems.

Procurement Management: Ensure the protection of information that suppliers of the CSP can access and monitor the agreed services and security requirements.

Incident Management: Ensure a consistent and comprehensive approach to the capture, assessment, communication and escalation of security incidents.

Business Continuity: Plan, implement, maintain and test procedures and measures for business continuity and emergency management.

Compliance: Avoid non-compliance with legal, regulatory, self-imposed or contractual information security and compliance requirements.

User documentation: Provide up-to-date information on the secure configuration and known vulnerabilities of the service for customers.

Dealing with information requests from government agencies: Ensure appropriate handling of government investigation requests for legal review, information to customers, and limitation of access to or disclosure of Customer Data.

Product security: Provide appropriate mechanisms for customers to enable product security.

The Provider shall implement practices for facilitating the switching of Providers and the porting of Customer Data in a structured, commonly used and machine-readable format including open standard formats where required or requested by the Customer.

The Provider shall ensure pre-contractual information exists, with sufficiently detailed, clear and transparent information regarding the processes of Customer Data portability, technical requirements, timeframes and charges that apply in case a professional user wants to switch to another Provider or port Customer Data back to its own IT systems.

The Provider shall not access Customer Data unless authorized by the Customer or when the access is in accordance with applicable laws in scope of the legally binding act.

The Provider shall provide transparency on the environmental impact of the Service Offering provided.

The Provider shall ensure that the Service Offering meets or relies on infrastructure Services Offerings which meets a high standard in energy efficiency, meeting an annual target of Power Usage Effectiveness of 1.3 in cool climates and 1.4 in warm climates.

The Provider shall ensure that the Service Offering meets or relies on infrastructure Services Offerings for which electricity demand will be matched by 75% renewable energy or hourly carbon-free energy by 31st December 2025, and 100% by 31st December 2030.

The Provider shall ensure that the Service Offering meets or relies on infrastructure Services Offerings that will meet a high standard for water conservation demonstrated through the application of a location and source sensitive water usage effectiveness (WUE)target of 0.4 L/kWh in areas with water stress.