information security; (3) define the recovery time objective (RTO) for information system and its priority to be recovered based on its criticality and potential impact; (4) consider redundant information

intermediary’s information cannot be recovered; (12) a clear term for subcontract of the cloud computing service should be in place. The term should provide, at a minimum, that such subcontracting is a part of the