The Register - Security

IEEE Spectrum Computing Channel

Feb 2, 2015

ENISA Cloud Certification Schemes Metaframework — ENISA

Press Release
Jan 29, 2015
http://enisa.europa.eu

ENISA publishes a meta-framework and an online tool to help customers with cloud security when buying cloud services.

ENISA launches CCSM, the “Cloud Certification Schemes Metaframework”. CCSM is a metaframework, which maps detailed security requirements used in the public sector to describe security objectives in existing cloudcertification schemes. The goal of CCSM is to provide more transparency about certification schemes and to help customers with procurement of cloud computing services.
This first version of CCSM  is restricted to network and information security requirements. It is based on 29 documents with NIS requirements from 11 countries (United Kingdom, Italy, Netherlands, Spain, Sweden, Germany, Finland, Austria, Slovakia, Greece, Denmark). It covers  27 security objectives, and maps these to cloud certification schemes.
Since last year ENISA has been working, together with the Cloud Select Industry Group on Certification Schemes and the European Commission, and produced 2 tools to help customers with cloud security. This work is part of the EU Cloud Strategy. The first tool, CCSL, is a list of (existing) information security certification schemes. CCSL was launched last year and is accessible online . CCSM is the second tool, and extension of CCSL.
CCSM is already being used:  the European Commission announced that they opened a large cloud services procurement tender (2500 cloud VMs and 2500 TB’s of cloud storage), which builds upon the 27 security objectives of CCSM. 
Udo Helmbrecht, Executive Director  of ENISA, said: “Cloud security is an important issue for both private and public sector customers in the EU. Obviously certification does not solve all the security issues, but it can simplify some of the procurement steps. This tool helps customers use existing certification schemes and it also offers cloud service providers a format for explaining security measures they take to protect their services.”
This version of CCSM has been implemented as an online tool. The tool maps different certification schemes to a single list of security objectives. The tool allows customers to choose the security objectives most relevant to them, and
  1. generate a matrix mapping to different cloud certification schemes, and/or
  2. generate procurement checklists or questionaires as printouts or spreadsheets.
Next steps for CCSM might be to include NIS requirements from other countries and to extend the scope of CCSM to include also NIS requirements specific for personal data protection.

Help Net Security - News

Latest articles from SC Magazine UK

Here's a phish you might not spot - 60 Sec Security

Biggest Information Security and Cybersecurity Misconceptions

Computer History Museum Videos

Slashdot: Your Rights Online

Public Key Cryptography: Diffie-Hellman Key Exchange

InfoWorld Security

ComputerWeekly.com - When IT Meets Politics

Nextgov.com News Articles

Electronic Privacy Information Center

Cyberlaw - Stanford Center for Internet and Society

SecurityWeek

European Public Policy Blog