Cloud Provider Assurance Workshop

  • TYPE: Workshop DATE: May 17, 2013 TIME: 09:00-16:00
Pre-Conference Events

Cloud services are outside the direct control of the customer organization and their use places control of the IT service and infrastructure in the hands of the CSP (Cloud Service Provider). A structured approach is essential to ensure organizational readiness for the cloud, to select the right service to meet business needs and other non-functional requirements like security and compliance and to enable that service to be assured. This approach applies good governance to the cloud through a combination of internal processes, standards and independent assessments.

This workshop is intended for the people in an organization that are concerned with procuring and assuring cloud services including:

  • IT Governance/Compliance/Audit managers
  • IT service managers
  • IT risk/security managers
  • Procurement and Legal managers
  • Line of business managers considering cloud services

This workshop uses real life scenarios to lead the participants through the steps necessary to assure that cloud services meet their organization’s business requirements. It is based on relevant industry standards and best practice including:

  • COBIT 5 and Cloud Computing
  • ISO 27001/2
  • CSA Star Certification
  • Government advice from ENISA, BSI and NIST
  • AICPA standards for Service Organization Control Reports.

The workshop will use a cloud project from the participants’ organization as a working example. You will need to bring details of this project with you to the workshop.

The process of Cloud provider assurance starts in the procurement process.  When moving to the cloud it is important that the business requirements for the move are understood and that the cloud service is selected meets these needs.  The cost of buying cloud services is within departmental budgets and sign-off limits.  This makes it easy for a group within a large organization to buy a cloud service without considering the risks in terms of legal issues such as data privacy as well as the needs for assuring the service. There should be a clear process for requesting IT services which includes cloud based services and this process should be sufficiently quick and user friendly to ensure that it is not bypassed by lines of business.

The workshop will take the participants through KuppingerCole’s five essential phases involved in a structured approach to selecting a cloud service.  This approach is based on good governance and best practice, and the workshop covers the detailed requirements for each of the phases.  The approach identifies the business requirements for the service.  The non-functional requirements such as information security together with the technical, compliance and legal requirements also need to be taken into account.  These business needs, technical requirements and risks form the basis for selecting and assuring the cloud service. 

This governance based approach closes the assurance loop by setting measurable controls, which are relevant to the risks and requirements, against which performance of the service can be monitored and independently audited.   It enables IT service performance to be related back to the strategic business requirements and provides verification that the on-going service provided is meeting the business needs.

The responsibility for assurance lies with both the cloud customer and the CSP.   The workshop will illustrate how the responsibilities between the customer and the CSP can be divided. The customer must understand the sensitivity of the applications and data being moved to the cloud so that security and compliance can be taken account of.  The customer together with the CSP should set and monitor controls to assure the service provided.  The CSP should use best practice to manage the service and provide access to monitoring of performance.

There is no shortage of advice on cloud computing; there are a least 35 different standards initiatives as well as frameworks, certifications and auditing standards.  This proliferation of standards and advice is causing confusion and uncertainty.  The workshop will help the participants to understand which of these are relevant to their business, and the CSP.  This workshop will explain the key standards and sources of advice:

  • COBIT 5/ISACA IT Control Objectives for Cloud Computing
  • ISO 27001/2
  • Cloud Security Alliance
  • German BSI
  • NIST

Independent assessment of CSPs is another important component of assurance. While it is reasonable for the provider to make monitoring information available; it is not be practical for the provider to allow every customer to perform their own audit. Periodic certification of providers by a trusted third party is a way to satisfy this need.  Certification can provide an independent confirmation of claims about services provided. However it is important to understand what these certifications and reports cover.  Specifically covered will be:

  • Cloud Security Alliance STAR Certification
  • SSAE  no. 16 (Statement on Standards for Attestation Engagements)
  • SOC (Service Organization Control Reports) Type 1, 2 and 3.
  • AICPA/CICA Trust Services Principles and Criteria

This workshop will use the example cloud service that you provide to lead the participants through the process necessary to assure that cloud services meet the needs of their organization.


Cloud Provider Assurance Workshop Agenda

Friday, May 17, 2013
09:00-10:30 Introduction to cloud services
Mike Small, Information Security Management Advisor, Fellow Analyst, KuppingerCole
10:30-11:00 Break
11:00-12:30 Cloud Provider Selection
Mike Small, Information Security Management Advisor, Fellow Analyst, KuppingerCole
12:30-13:30 Lunch Break
13:30-14:30 Cloud Provider Assurance
Mike Small, Information Security Management Advisor, Fellow Analyst, KuppingerCole
14:30-15:00 Break
15:00-15:30 PCI Compliance and the Cloud
Guy Balzam, Principal Product Manager, Security, CA Technologies
15:30-16:00 Final interactive discussion and wrap up


Continuing Education Credits

After attending this workshop you will be able to:

  1. Identify the key assurance challenges of the different kinds of Cloud Computing.
  2. Select a cloud service that is appropriate for your business needs,
  3. Implement a structured process for selecting cloud services,
  4. Use the KuppingerCole five phase process for selecting a cloud service,,
  5. Select the cloud assurance approach that is right for your organization based on the existing standards, frameworks, advice and certifications.
  6. Evaluate the assurance needs for cloud services that are already being used in your organization.

This event qualifies for 4 CPE

Prerequisites: None
Advance Preparation: None
Learning Level: Intermediate
Field: Computer Science

Who should attend: CIOs, CISOs, IT Managers, and the project managers and IT professionals with 3 or more years’ experience.

KuppingerCole is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing education on the National Registry of CPE Sponsors. State Boards of accountancy have final authority on the acceptance of individual courses for CPE credits. Complaints regarding registered sponsors may be submitted to the National Registry through its website:

For more information regarding administrative policies such as complaint and refund, please contact Mr. Levent Kara at our office's telephone +49 211 23707710, email:

Stay Connected



Cloud Provider Assurance Workshop

Registration fee:
€995.00 $1194.00
Contact person:

Mr. Levent Kara
+49 211 23707710
  • May 17, 2013 09:00-16:00 Munich/Germany


The Cloud Provider Assurance Workshop is proud to present a huge number of partners
Learn more

How can we help you

Send an inquiry

Call Us +49 211 2370770

Mo – Fr 8:00 – 17:00