Cloud Computing ComplianCe Controls Catalogue (C5) | struCture and Contents oF C5

2 Structure and contents of C5

2.1 Structure of C5 starting point for requirements which the cloud

Cloud services in terms of C5 are IT services
which are made available to the customer by a
service company (cloud provider, provider or ser-
vice provider) over a network. Cloud services are
offered, used and billed elastically and adapted to
the requirements by defined technical interfaces
and protocols. The range of the services offered
within the cloud computing framework covers
the entire spectrum of information technology
and, among other things, includes infrastructure
(e. g. computing power, storage), platforms and
software.
C5 itself is subdivided into 17 sections (see
section 2.2).
An objective is assigned to each section (see
section 2.2). The objective provides the cloud
provider a summarised target which they have to
fulfill in the related section through correspond-
ing organisational and operational measures and
(procedural) organisation.
Individual requirements are assigned to each
objective (see section 5). The requirements specify
general principles, procedures and measures
for fulfilling the objective. In this respect, a
distinction is made between basic requirements
and additional, optional requirements. The basic
requirements are essential and the cloud provider
has to meet and at least comply with as part of an
audit according to this catalogue.
customers could specify based on their individual
use case.
The cloud provider is responsible for the design,
description, implementation and effective opera-
tions of organizational and operational measures
(controls) with which the requirements are imple-
mented at the cloud provider. The entirety of the
required measures is part of their internal control
system concerning the cloud services. The design
of this internal control system depends on the
type of cloud service provided, the requirements
of the cloud customers and the company goals
of the cloud provider as well as on the associated
specific risks.
A speciality in C5 are the so-called surrounding
parameters for transparency which precede the
requirements. Surrounding parameters for trans-
parency address the transparency with respect
to the general conditions according to which the
cloud service is provided (e. g. the place of juris-
diction). By means of the information resulting
from auditing these surrounding parameters for
transparency, the customer can decide on the
general suitability of the cloud service according
to their internal targets.

In addition to some basic requirements, addi-

tional, optional requirements are defined. They
are classified as to whether especially confiden-
tiality (C), availability (A) or both properties at
the same time (C/A) are addressed with respect
to the data processed in the cloud service. It
turned out that there are no effective higher-level
requirements for integrity (I) in addition to the
basic requirements, which is why this category is
missing here. The additional requirements are a

13