User:Shawndouglas/sandbox/sublevel1

Numerous organizations have taken up the mantle in developing and disseminating cloud compliance standards, guidelines, and recommendations since the late 2000s, some independently (e.g., the Storage Networking Industry Association) and others by government mandate (e.g., National Institute of Standards and Technology). Some organizations have tailored their content to a specific industry (e.g., PCI Security Standards Council and the financial industry), while others have focused on a sector of business (e.g., FedRAMP and the U.S. Federal government). As the development of these standards, guidelines, and recommendations has continued, the groundwork has been created for future updates. NIST's early work with its SP 500-293 NIST Cloud Computing Technology Roadmap, Volume I and II and SP 500-299 NIST Cloud Computing Security Reference Architecture (Figure 3) have gone on to further define a modern approach to categorizing, evaluating, comparing, and selecting cloud services. And those documents were influenced by even earlier work by the Cloud Security Alliance's Enterprise Architecture efforts.

The work to improve and expand upon existing standards continues today, even as new service models for cloud computing emerge. Examples of the prior mentioned and other organizations contributing to these efforts are shown in Table 3.

Table 3. Organizations that have developed and are developing cloud compliance standards, guidelines, recommendations, and frameworks
Organization	Description	Link to standards, etc.
Crown Commercial Services and G-Cloud	Though not a standards organization, the U.K. Crown Commercial Service's (CSS's) G-Cloud program and framework allows companies considering selling cloud-based services to the U.K. government to make their services available "through a front-end catalogue called the Digital Marketplace." The framework agreements place specific requirements on the various services being offered by the provider, and in return, the provider can bid on government opportunities without going through the full procurement process.	G-Cloud standards, etc.
DMTF	Formerly known as the Distributed Management Task Force, DMTF "creates open manageability standards spanning diverse emerging and traditional IT infrastructures." This includes cloud standards, virtualization standards, networking standards, and more.	DMTF standards, etc.
European Telecommunications Standards Institute	ETSI "supports the timely development, ratification and testing of globally applicable standards" for information and communications technology (ICT) hardware, software, and services.	ETSI standards, etc.
General Services Administration and FedRAMP	Though not a standards organization, the U.S. General Services Administration's (GSA's) FedRAMP program "provides a standardized approach to security authorizations for cloud service offerings" for the U.S. Federal government. FedRAMP "standardizes security requirements for the authorization and ongoing cybersecurity of cloud services" as authorized by a number of regulations and policies.	FedRAMP standards, etc.
IEEE Standards Association	IEEE's Standards Association, which attempts "to facilitate standards development and standards related collaboration," has a Cloud Computing Initiative that has developed several working drafts related to cloud computing.	IEEE SA standards, etc.
International Organization for Standardization (ISO)	The ISO is a primary global standards organization that has been developing a wide variety of standards for decades. Numerous cloud-computing standards have been published under International Classification for Standards (ICS) code 35.210.	ISO standards, etc.
International Telecommunication Union (ITU)	The ITU is the United Nation's specialized agency for information communication technologies (ICTs). Among their activities, the agency develops technical standards and facilitates international connectivity in communication networks. Many recommendation documents have been developed through its Telecommunication Standardization Sector (ITU-T), SG13 Study Group, including cloud computing recommendations (Y Series).	ITU-T standards, etc.
National Institute of Standards and Technology (NIST)	NIST is a U.S. Department of Commerce institute which focuses on scientific measurement and standardization. They have developed a numbers roadmaps, guidelines, and definitions through its SAJACC and NCCP initiatives.	NIST standards, etc.
OMG Cloud Working Group	Previously known as the Cloud Standards Customer Council (CSCC), OMG's Cloud Working Group (CWG) "publishes vendor-neutral guidance on important considerations for cloud computing adoption, highlighting standards, opportunities for standardization, cloud customer requirements, and best practices to foster an ecosystem of open, standards-based cloud computing technologies."	CWG standards, etc.
Open Grid Forum (OGF)	The OGF is "an open global community committed to driving the rapid evolution and adoption of modern advanced applied distributed computing, including cloud, grid and associated storage, networking and workflow methods."	OGF standards, etc.
Organization for the Advancement of Structured Information Standards (OASIS)	OASIS Open is a standards body that "offers projects—including open source projects—a path to standardization and de jure approval for reference in international policy and procurement."	OASIS Open standards, etc.
PCI Security Standards Council (PCI SSC)	PCI SSC "is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide."	PCI SSC Open standards, etc.
Storage Networking Industry Association (SNIA)	SNIA develops and promotes "vendor-neutral architectures, standards, and educational services that facilitate the efficient management, movement, and security of information," including the Cloud Data Management Interface (CDMI) standard.	SNIA standards, etc.
The Open Group	This organization attempts "to capture, clarify, and integrate current and emerging requirements, establish standards and policies, and share best practices."	Open Group standards, etc.
TM Forum	This global alliance attempts "to collaboratively solve complex industry-wide challenges, deploy new services and create technology breakthroughs to accelerate change." As a result of this collaboration, several technical documents and guides related to cloud computing have been developed.	TM Forum standards, etc.

However, organizational standards, guidelines, and recommendations alone do not influence how cloud computing services can and should be implemented and operated. Regulatory bodies, legislative bodies, and government agencies also directly or indirectly have an impact on cloud service operations. In some cases, the law, regulation, or guidance coming from such bodies may not even mention "cloud computing," yet because they mandate how specific data and information can be managed, used, and distributed, they ultimately influence what a cloud service provider (CSP) does and how they do it. This can be observed by more than a few of the examples in Table 4. The California Consumer Privacy Act, for example, makes no mention of the word "cloud," but CSPs and cloud users alike must consider aspects of the regulation, e.g., what can and cannot be done with a consumer's information based on location of the stored information.

Table 4. Examples of some common regulations, recommendations, and guidance that shape the proper use of cloud-computing platforms
Regulation, recommendation, or guidance	Creator	Description	Link
California Consumer Privacy Act (CCPA)	The State of California	The CCPA "provides California consumers with a number of privacy protections, including right to access, delete, and opt-out of the 'sale' of their personal information." Cloud solutions such as Google Cloud attempt to help users meet CCPA obligations, as well as meet their own commitments.	Link
Cloud Computing Regulatory Framework (CCRF)	Kingdom of Saudi Arabia	The KSA's CCRF "is based on international best practices and governs the rights and obligations of cloud service providers (CSPs), individual customers, government entities and businesses." It is one of only a few existing cloud-specific regulatory frameworks created by a government.	Link
Cloud Security Principles	Government of the United Kingdom	The U.K. developed a collection of 14 Cloud Security Principles that "include important considerations such as protection of data in transit, supply chain security, identity and authentication, and secure use of cloud services." This is an example of a national government developing a cloud-specific set of guidance for its public sector.	Link
Federal Information Security Modernization Act of 2014 (FISMA)	United States Government	Amending the prior FISMA 2002, FISMA 2014 achieves several things, chief among them giving Federal government the ability to better respond to cybersecurity attacks on its departments and agencies. Compliance with FISMA means implementing "recommended information security controls for federal information systems as identified in the NIST SP 800-53."	Link
General Data Protection Regulation (GDPR)	European Union	The GDPR is a non-trivial regulatory hurdle with positive intentions, with the goal of strengthening personal data protection in Europe. The regulation "lays out specific requirements for businesses and organizations who are established in Europe or who serve users in Europe." Cloud vendors like Google may stipulate in their contracts with European clients how they meet that guidance, as well as offer tools, documentation, and other resources to assist with assessment of the vendor's services.	Link
Guidance on Outsourcing to Cloud Service Providers	Germany's Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)	BaFin's Guidance document on cloud service outsourcing "provides specific outsourcing guidance for financial institutions on contractual terms, including information and audit rights, the right to issue instructions, data security / protection, termination and chain outsourcing." Cloud vendors like Google may stipulate in their contracts with German clients how they meet that guidance.	Link
Health Insurance Portability and Accountability Act (HIPAA)	United States Government	The HIPAA Rules "establish important protections for individually identifiable health information ..., including limitations on uses and disclosures of such information, safeguards against inappropriate uses and disclosures, and individuals’ rights with respect to their health information." HIPAA compliance is so vital for some organizations that U.S. government entities like the U.S. Department of Health & Human Services (HHS) have published their own guidance towards how HIPAA covered entities can best comply when using cloud services.	Link
Joint Statement: Security in a Cloud Computing Environment	Federal Financial Institutions Examination Council (FFIEC)	In this document, the FFIEC—an interagency group of federal and state banking regulators—addresses "the use of cloud computing services and security risk management principles in the financial services sector" and "highlights examples of risk management practices for a financial institution’s safe and sound use of cloud computing services and safeguards to protect customers’ sensitive information from risks that pose potential consumer harm."	Link
OMB Circular A-130, Managing Information as a Strategic Resource	United States Government	This (revised) Obama-era circular "establishes general policy for the planning, budgeting, governance, acquisition, and management of Federal information, personnel, equipment, funds, IT resources, and supporting infrastructure and services," including cloud services. In addition to FISMA, this circular supports the FedRAMP program and its standardized security requirements.	Link
Personal Data Protection Law (KVKK)	Government of Turkey	Turkey's KVKK (Kişisel Verileri Koruma Kanunu) "regulates the protection of personal data and outlines the obligations that entities and individuals dealing with personal data must comply with." It has significant relevancy to cloud computing efforts in the country.	Link
Protective Security Policy Framework	Australian Government	The PSPF "assists Australian Government entities to protect their people, information, and assets, both at home and overseas." It contains multiple statements about how cloud computing should be handled.	Link

While Big Tech was as early as 2010 asking the U.S. government to take a more proactive regulatory approach to cloud computing, actual direct regulation of cloud computing by the world's governments has been limited. This leads to complicated viewpoints about the value of regulation vs. its drawbacks. Yes, careful regulation can help ensure consistent, affordable, and secure access to cloud services and may even encourage organizations to adopt the technology. However, a headstrong approach to regulations for CSPs, without sector- and industry-specific considerations, may have unintended consequences, e.g., unduly raising compliance costs or forcing insufficient levels of access control on an entity.

At least in the U.S., lawmakers and regulators may soon be pressured to increase regulatory approaches to cloud computing. This may be driven by the increasingly concentrated nature of cloud services in a handful of tech giants, though at the same time hampered by the widely varying approaches to addressing cloud-related issues via policy and regulation at the national and international levels. First, the very nature of these cloud services—and the ever increasing criticality they attain—as centralized services ensures the regulatory eye will increasingly be placed upon those cloud vendors. In fact, discussion about and designation of cloud services as critical infrastructure is already occurring in earnest, as they have "become essential to the performance of a growing swath of other sectors that have not heretofore been massively dependent on centralized cloud functionalities, and hence vulnerable to their disruption." This may lead to policymakers, regulatory bodies, and legislators being left with little choice but to move forward with more policy and regulation. Second, and consequently, the development of such policy and regulation may not occur in a manner more unified with global perceptions but rather largely based upon localized values, interests, and priorities. The failure here is the lack of recognition of CSPs as being integral to individual, retail, corporate, organizational, and government operations around the globe, i.e. their centralized and concentrated position within a changing computing paradigm. As such, greater effort must be made by policymakers, regulators, and legislatures to find at least a minimum level of "compatibility and reconciliation" with other existing governance mechanisms, while carefully addressing both security of operation and operational robustness in tandem, such that there is greater harmonization globally. And through government-level support of harmonized controls—as well as a vested interest in promoting the responsible "development, dissemination, and operation of cloud infrastructure"—cloud users will stand a greater chance of reaping the economic benefits of adopting cloud computing.

Current and future regulatory action applies to several areas of cloud computing. How a CSP responds to and notifies affected users of a security breach is one concern. Currently the U.S. government doesn't fully address in a unified fashion aspects of cloud security breaches such as protection obligations, reporting time, and required notification parties, nor any compensation mechanism for those affected. (All U.S. states and most territories do have their own flavor of breach notification legislation, but like cannabis law, this is problematic in the face of a strong divergence with federal law or lack thereof.) The applications and algorithms that drive and collect data from users of cloud-enabled applications may also face regulatory scrutiny or control by a national government, as was seen with both China's and the U.S.'s scrutiny of the TikTok application, its algorithms, and its security. Data localization also remains a significant area of cloud computing regulation, not just for security concerns but also industrial policy, economic policy, privacy concerns, and human rights concerns. Other areas of concern that may see regulation include interoperability and portability, digital preservation (retention) obligations, and cross-border data transfer.

And then there's the proverbial "elephant in the room": overall data privacy and protection considerations in the cloud. This is a major concern typically because of statutes—like the California Consumer Privacy Act—that broadly protect a collective of affected individuals and how their cloud data is collected, preserved, organized, stored, and used not only within the governing entity (e.g., state, country, political and economic union) but also as its transferred to and from the governing entity. The previously mentioned data localization and cross-border data transfer issues fall under this heading. These often prove to be some of the most challenging regulations to develop, as lawmakers and regulators don't always anticipate the rate of change of technology. They're also difficult for CSPs and organizations to comply with, particularly due to the variance in requirements among all governing entities' laws.

Other approaches to regulation also affect how cloud computing services are implemented and managed. For example, rather than taking a broad approach towards regulation, addressing everyone providing and/or using cloud services, it's possible that regulators and legislators may take a more focused, sector-based approach. But that comes with its own set of problems, as Maurer and Hinck noted in their 2020 Carnegie Endowment paper:

[T]he impact of a cloud security incident usually depends on what type of data or service is affected. Thus, the most suitable potential regulatory requirements with respect to security may differ across sectors that deal with different types of data—from the highly sensitive, fast-moving data common in the financial sector to the more privacy-sensitive personal data used by medical service providers. However, crafting regulation on a sector-by-sector basis would likely create conflicting requirements and incomplete standards.

Finally, as a third option, rather than direct regulation of the broad market or even specific sectors, some governments may simply use their considerable weight to influence how CSPs provide their services, influencing future regulation, as Levite and Kalwani note in their 2020 paper for the Carnegie Endowment:

Finally, some of the efforts to influence CSP behavior may not come through explicit regulation, but rather through exercise of the government’s market power. Cloud adoption strategies and trends in e-governance have made governments some of the largest and most important clients of CSPs. Governments will likely use their market clout and status as a large and powerful consumer as a source of leverage over industry to set standards of contracting fairness and other provisions that transcend the immediate cloud service contracts they enter. While formally these provisions will only apply to government contracts, they could over time cross over to public clouds as well, or at least help set precedents that drive regulatory attention and inform industry standards. Yet over the longer run, government privatization of many services might actually weaken their leverage, given lock-in issues. How the balance between the two parties ultimately will play out remains to be seen.

Whatever direction regulators and legislators take, it ideally will be done with thorough consideration of how to implement regulation, as well as the potential effects regulation will have on various markets.