Assuring Cloud Security and Compliance

The Coronavirus pandemic forced rapid changes in how organizations operate, accelerating digital transformation by up to five years within months. This shift relied heavily on cloud services and cloud-based applications, enabling business continuity while creating new cybersecurity and compliance challenges. As organizations moved to hybrid IT models spanning cloud, on-premises, edge, and hosting, they lost direct control over much of the infrastructure, and security/compliance responsibilities became shared between cloud service providers (CSPs) and cloud tenants. This shared responsibility can be confusing, leading to security gaps that adversaries can exploit and increasing the risk of compliance failures.

Core cybersecurity objectives remain consistent regardless of delivery model: confidentiality, integrity, availability, and compliance. However, tenants cannot directly control how CSPs deliver and secure services, so assurance must be governance-driven: define clear, measurable requirements and verify they are met. Since individual customer audits are impractical at cloud scale, industry standards and independent assessments become essential tools for assurance, providing accepted benchmarks and measurable objectives.

The document emphasizes Zero Trust—“never trust, always verify”—as highly relevant to cloud use, especially when cloud services deliver security-critical functionality. It describes four trust levels, concluding that independent third-party audits (Level 3) are currently the most practical path for most organizations. A wide landscape of laws, frameworks, and standards applies, particularly in Europe, where the German BSI C5 standard is increasingly adopted and is planned to inform a European Secure Cloud label alongside initiatives like SecNumCloud. Finally, it distinguishes security from compliance: strong security controls are foundational, but do not automatically satisfy legal obligations such as GDPR, even though they support requirements like GDPR Article 32.

• Digital transformation was accelerated by up to five years in a matter of months.
• Cybersecurity objectives are confidentiality, integrity, availability, and compliance.
• Security and compliance responsibilities in cloud services are shared between the CSP and the tenant.
• Cloud-based software companies such as Workday, Salesforce, and Duo are categorized as cloud tenants.
• The German C5 standard (Cloud Computing Compliance Criteria Catalogue) was introduced in 2016.
• C5 is designed and managed by Germany’s Federal Office for Information Security (BSI).
• C5 assessments are designed to be performed using the AICPA SSAE 18 audit standard, which updates and replaces SSAE-16.
• The CSA Cloud Controls Matrix includes 197 control objectives structured across 17 domains.
• SOC 2 reports have Type I (existence of controls) and Type II (existence and effectiveness of controls) variants.
• In all cloud service models, the tenant is responsible for managing access to the service and securing the data it contains.

• “This has led organizations to accelerate their digital transformation by up to 5 years in a matter of months.”
• “The objectives of cybersecurity are the same however IT services are delivered.”
• “This shared responsibility can cause confusion.”
• “However, the tenant has no direct control over how a cloud service is delivered, managed, and secured.”
• “A standard provides the distilled wisdom of the best people in the industry.”
• “It is important to emphasize that compliance with standards and frameworks should go beyond a minimal collection of reporting obligations.”
• “Based on the principle ‘never trust, always verify,’ Zero Trust is designed to protect modern digital environments.”
• “Currently for most organizations, Level 3 is the most practical approach.”
• “Security controls provide an essential foundation for regulatory compliance.”
• “There is no such thing as perfect security and so organizations must take a risk-based approach to the use of cloud services.”