Enthusiasm surrounding the rapid growth and acceptance of cloud technology resulted in the creation of numerous standards and open source activity focused on cloud users and their needs. This led to market confusion around which standards are the most appropriate -- a major cloud compliance challenge for enterprises.
It is incumbent upon organizations using cloud technology -- or those contemplating the use of cloud-based services -- to ensure the cloud providers selected comply with established standards and best practices.
IT leaders can use this article to learn about cloud compliance standards and to understand which questions to ask existing and prospective cloud providers about their efforts at complying with specific standards, as well as how to select the appropriate standards for their specific organization.
Numerous professional and technical organizations address various aspects of cloud technology, offering their own standards, recommendations and guidance for successful cloud implementation.
CSCC is an end-user support group focused on the adoption of cloud technology and examining cloud standards and security and interoperability issues. It has produced numerous white papers and articles on cloud issues. It has been superseded by the Cloud Working Group and addresses cloud standards issues via its Cloud Working Group.
DMTF supports the management of existing and new technologies, such as cloud, by developing appropriate standards. Its working groups, such as Open Cloud Standards Incubator, Cloud Management Working Group and Cloud Auditing Data Federation Working Group, address cloud issues in greater detail.
ETSI primarily develops telecommunications standards. Among its cloud-focused activities are Technical Committee CLOUD, the Cloud Standards Coordination initiative and Global Inter-Cloud Technology Forum, each of which addresses cloud technology issues.
OGF develops standards for grid computing, cloud, and advanced digital networking and distributed computing technologies. Among its cloud-focused activities is the Open Cloud Computing Interface working group, which has developed several cloud operating specifications, including the OCCI Core specification and OCCI Infrastructure extension.
Formerly known as the Open Cloud Consortium, OCC provides management of cloud computing and data commons -- an open knowledge repository -- resources in support of a variety of academic and scientific research initiatives.
This nonprofit organization develops open standards for security, cloud technology, IoT, content technologies and emergency management. Its various cloud technical committees include OASIS Cloud Application Management for Platforms, OASIS Identity in the Cloud, and OASIS Topology and Orchestration Specification for Cloud Applications.
This specification is now an ISO standard, ISO/IEC 17826:2012, Information technology -- Cloud Data Management Interface. Typically used by cloud storage systems developers, it defines an interface to access cloud storage and to manage the data stored within the cloud resource.
This consortium of technology industry organizations develops standards and accreditations for a variety of IT issues. Its Open Platform 3.0 Forum working group's activities focus on mobility, big data analytics and cloud computing.
TM Forum is a global consortium of technology firms that provides a collaborative platform to address technology issues. Its Cloud Services Initiative provides a resource to develop cloud standards to be used by technology firms and users alike.
Two organizations that have developed a number of cloud-focused standards are NIST and ISO. Here, review a sampling of current, commonly used cloud compliance standards from these respective standards organizations.
NIST develops and distributes standards primarily for government use but which are widely used by private industry. Its Special Publications (SP) Series of standards, including the following, is used extensively in public and private sectors:
This is one of the primary global standards-making organizations. It develops standards for dozens of different kinds of technologies and systems, including the following:
To determine appropriate cloud compliance standards for their respective companies, IT leaders should conduct research into the various cloud compliance standards, working groups and technical committees described in this article. Examine the standards being used by major cloud service providers, such as AWS and Microsoft. Chances are IT departments will have already performed considerable due diligence in these issues, so achieving compliance with standards will be an important outcome.
Conversely, when using a third party for a cloud implementation, check to see how it achieves cloud standards compliance. This can be incorporated into the evaluation process.
Another way to evaluate cloud providers' compliance efforts is to examine the most recently released Service Organization Control Type 2 (SOC 2) reports. SOC 2 reports examine the controls used by the vendor to protect customer data and verify the operational effectiveness of those controls. For cloud service providers, SOC 2 reports can also document the standards and practices the vendor uses to protect the security and privacy of user data.
17 Dec 2020