ENISA Cloud Certification Schemes Metaframework

ENISA launches CCSM, the “Cloud Certification Schemes Metaframework”. CCSM is a metaframework, which maps detailed security requirements used in the public sector to describe security objectives in existing cloud certification schemes. The goal of CCSM is to provide more transparency about certification schemes and to help customers with procurement of cloud computing services.

This first version of CCSM  is restricted to network and information security requirements. It is based on 29 documents with NIS requirements from 11 countries (United Kingdom, Italy, Netherlands, Spain, Sweden, Germany, Finland, Austria, Slovakia, Greece, Denmark). It covers  27 security objectives, and maps these to 5 cloud certification schemes.

Since last year ENISA has been working, together with the Cloud Select Industry Group on Certification Schemes and the European Commission, and produced 2 tools to help customers with cloud security. This work is part of the EU Cloud Strategy. The first tool, CCSL, is a list of (existing) information security certification schemes. CCSL was launched last year and is accessible online . CCSM is the second tool, and extension of CCSL.

CCSM is already being used:  the European Commission announced that they opened a large cloud services procurement tender (2500 cloud VMs and 2500 TB’s of cloud storage), which builds upon the 27 security objectives of CCSM. 

Udo Helmbrecht, Executive Director  of ENISA, said: “Cloud security is an important issue for both private and public sector customers in the EU. Obviously certification does not solve all the security issues, but it can simplify some of the procurement steps. This tool helps customers use existing certification schemes and it also offers cloud service providers a format for explaining security measures they take to protect their services.”

This version of CCSM has been implemented as an online tool. The tool maps different certification schemes to a single list of security objectives. The tool allows customers to choose the security objectives most relevant to them, and

1. generate a matrix mapping to different cloud certification schemes, and/or
2. generate procurement checklists or questionaires as printouts or spreadsheets.

Next steps for CCSM might be to include NIS requirements from other countries and to extend the scope of CCSM to include also NIS requirements specific for personal data protection.

For full report and online tool: https://resilience.enisa.europa.eu/cloud-computing-certification

Background:

• European Commission press release: EU tech companies invited to bid to provide Cloud services for the EU
• New Schemes on the Cloud Certification List (CCSL) : http://www.enisa.europa.eu/media/news-items/new-schemes-on-the-cloud-certification-list-1
• Certification in the EU Cloud Strategy: https://resilience.enisa.europa.eu/cloud-computing-certification/certification-in-the-eu-cloud-strategy

For interviews:  Dr. Marnix Dekker, NIS expert, and Dimitra Liveri, Security & Resilience of Communication Networks, at cloud.security@enisa.europa.eu