Monitoring Bodies must be accredited by a competent supervisory authority, the CNIL in this case. Monitoring Bodies are entirely independent of CISPE.
Each Monitoring Bodies will enter into an agreement with the cloud service providers which are candidates to the certification against the CISPE code. CISPE does not provide a template for such agreements and Monitoring Bodies and the service providers define their relations and the applicable terms within the requirements provided for by the GDPR, the applicable national law and the competent Data Protection Authority.
A checklist of requirements defined in Annex B of the CISPE Code providing guidance on expected controls, sample questions and evidence necessary to verify compliance. The Monitoring Bodies will also issue a detailed assessment methodology.
CISPE does not enter into a contractual relationship with the Monitoring Body.