C5 cloud criteria catalogue: the clauses behind the split

Segregate the traffic of different cloud customers in shared network environments at network level following a documented segregation concept, so transmitted data retains its confidentiality and integrity between tenants.

Operate key management spanning generation, certificate issuance, activation, storage isolated from application and middleware layers, authorised retrieval, rekeying, compromise handling, withdrawal and deletion, with separate rules stated where pre-shared keys are used.

Issue secure development policies covering the whole service lifecycle and grounded in recognised standards, addressing security in requirements, design, implementation, testing and verification, in software deployment including continuous delivery, and in reacting to faults and vulnerabilities during operation.

Operate an information security management system aligned to ISO/IEC 27001 covering the organisational units, sites and processes that deliver the cloud service, and retain documented scope, statement of applicability and the latest management review results.

Document and communicate backup and recovery policies fixing backup scope, frequency and retention against contractual and internal RTO and RPO targets, requiring state of the art encryption of backups, restricting restores to authorised persons and mandating recovery testing.

Establish written logging and monitoring policies for systems in the provider's area of responsibility that define which events could breach protection goals, how logs are activated, paused and stopped, their purpose and retention, role responsibilities, time synchronisation and legal obligations.

Publish technical and organisational rules for vulnerability handling requiring regular identification of vulnerabilities, assessment of their severity, prioritised remediation or mitigation within defined timelines, and a defined treatment for components where no timely fix will be applied.

Keep affected cloud customers informed at regular intervals on the status of incidents concerning them, involve them in resolution where appropriate and necessary, and tell them what action was taken once the incident is resolved, all as the contract provides.

Erase customer data at the end of the contractual relationship in line with the agreed terms, covering the customer environment, metadata and backup copies, using methods that defeat recovery by forensic means.

Control entry at every access point using an access control system whose documented rules grant least privilege authorisations, revoke unused rights after two and six months, enforce two factor authentication for areas holding customer data, escort visitors and log all entries.

Where customers run virtual machines or containers, let the customer restrict which images its users may launch, inform the customer of what changed between versions of any images the provider supplies, and harden those provider supplied images to generally accepted industry standards.

Let the cloud customer choose, from the options available under its contract, the location or country in which its data is processed, stored and backed up, and ensure the cloud architecture itself enforces that choice.

Document, communicate and make available policies governing third parties whose services support the cloud service, covering procurement risk assessment, subcontractor classification, security and training obligations, legal duties, vulnerability handling, contractual wording, monitoring, and flow down to their own providers.