Cloud Certification and Auditing

• Improve communications channels between government and industry to provide feedback on and refine existing certifications processes by identifying areas in need of adjustment. These include a clear delineation of roles and responsibilities among auditing entities, irregularities in risk assessment, and validation across authorizers. (Shared with governments.)
• Work with governments and enterprise customers to define high-level performance-based requirements and metrics for confidentiality, integrity, and availability of cloud services. These can differ based on the types of cloud service offered (such as storage and virtualization) and sectoral criticality. (Shared with governments and enterprise customers.)
• Help customers understand their new or potentially modified responsibilities under future performance-based certifications.

Incident Handling Procedures

• Proactively identify and define in contracts and/or SLAs roles in incident response and crisis communication vis a vis different cloud incident scenarios.¹ (Shared with customers.)
• Collaborate in the development of standards to ensure confidentiality in sharing of sensitive incident information. (Shared with customers and insurers.)
• Provide timely notification to governments and impacted individuals in the event of a cloud incident. (Shared with customers.)
• Commit to disclosing information about their own security practices with appropriate government agencies to aid in incident response and recovery coordination internal security practices.
• Work with cloud providers, customers, insurers, credit rating agencies, and other key stakeholders to determine appropriate disclosure constituencies, documentation, and timelines.² (Shared with governments, customers, credit rating agencies, and insurers.)
• Perform system penetration and stress tests (potentially also including “bug bounty/White Hat hacker” programs) to assist in detection of vulnerabilities and simulation of incident response. (Shared with governments and enterprise customers.)
• Commit to sharing relevant incident information with other cloud providers to assist in the prevention or mitigation of potential spillover across cloud systems.³

Localization and Routing Requirements

• Work with governments to understand distributed processes of data routing and work with other stakeholders to increase confidence in the security of data in transit. (Shared with governments and customers.)
• Educate concerned parties on the distributed process of data routing and its role in cloud service functionality and resilience.
• Work with governments to jointly develop reference designs and technical artifacts⁴ to better demonstrate how the cloud provides for data security at rest and in motion. (Shared with governments.)
• Commit to and encourage the adoption of actions that enhance routing security.⁵

Security and Privacy in Lawful Government Access

• Inform enterprise customers of government access requests in every circumstance permitted by law.⁶
• Publish, on a regular basis, transparency reports detailing aggregate statistics on government access requests (including requests received from foreign governments).⁷ (Shared with enterprise customers.)
• Develop industry standards for challenging and, where appropriate, rejecting certain overbroad government access requests (for example, requesting unfettered access, encryption keys, ability to break encryption). (Shared with enterprise customers.)
• Dissuade government access requests that do not meet agreed-upon criteria (such as requesting unfettered access, encryption keys, ability to break encryption) and challenge these requests through legal actions and public relations.

Data Retrievability and Back-up Arrangements

• Create multiple retrieval and backup strategies and mechanisms for each service offered and which develop contingency plans for widespread disruptions from diverse sources.⁸
• Provide customers with guidance materials in support of their development of disaster recovery and data restoration strategies.
• Regularly carry out drills to test disaster recovery plans. (Shared with enterprise customers.)
• Increase transparency of their global dependencies that may impact customers’ capacity to retrieve and/or backup data.
• Consider adopting practices compliant with international and other key information security standards (such as SOC 2⁹ and ISO27001¹⁰). (Shared with enterprise customers.)

Government Intervention in Extremis

• Work with governments to ensure customer data is protected in the event of intervention. (Shared with customers.)
• Implement technical fail-safes that ensure government intervention does not compromise the security of cloud services.
• Ensure enterprise customers are insured against potential abuse or data mismanagement in cases of intervention. (Shared with enterprise customers.)
• Participate in working groups between governments, providers, and enterprise customers to delineate clear “disaster level” thresholds for government takeover and eventual release. (Shared with governments and enterprise customers.)
• Increase cooperation with governments and enterprise customers by participating in joint preparedness exercises. (Shared with governments and enterprise customers.)

Insurance for Cloud Services ​

• Collaborate with insurers (and potentially governments) to offer comprehensive coverage for risks emanating from cloud failures.
• Provide insurers with visibility into their cloud technology and operations in order to inform the development of cloud insurance offerings
• Work with governments and insurers to assign concerned stakeholders responsibilities and liabilities in the event of a cloud incident (including a sophisticated attack by a nation-state). (Shared with governments, enterprise customers, and insurers.)
• Help identify the conditions under which government backstopping mechanisms would take effect. (Shared with governments, enterprise customers, and insurers.)

Portability and Interoperability

• Develop and promote (in coordination with other providers) voluntary industry norms on portability and interoperability (for example, advancing a “customer bill of rights” for workload portability that includes technical and operational [licensing] standards and principles, such as a “transparency declaration,”¹¹ to help customers understand available accommodations, which data can be imported and exported, as well as which data standards, formats, and file types are recommended, used, or available).
• Encourage agreement on common terminology and principles for portability and interoperability in consultation with governments and customers. Definitions for these terms have been formalized in standards, including SWIPO’s Codes of Conduct,¹² IEEE’s P2301/P2302,¹³ ISO/IEC’s 19941.¹⁴ Develop appeals and complaint procedures¹⁵ whereby customers may raise concerns associated with (in)action by providers.
• Adhere to existing standards on open-source code and applications.

Commercialization of Customer Data

• Voluntarily disclose more information about data-processing practices, including with respect to data sharing, the sale of data, and the categories of data collected and used. (This may be a competitive advantage as it can improve customer confidence in their cloud providers.)
• Provide transparency into the internal decision-making process regarding what consumer and enterprise-derived data will be used and for what purposes.

Effects of Cloud Market Concentration

• Participate in industry-led dialogues to develop and advance technical standards for portability and interoperability between major providers.¹⁶
• Adopt standards on fairness and transparency in contracting, pricing, and liability.

Environmental, Community, and Energy Market Impact

• Support cross-sector and -industry initiatives to reduce carbon emissions and harmful waste through the development of guidance materials and communication of best practices.
• Adopt use of more sustainable server cooling methods.¹⁷
• Commit to reduce and improve water usage in data centers.¹⁸
• Providers may need to also focus on carbon capture/removal strategies.
• Collaborate with utility companies to identify “brownfield” sites¹⁹ for constructing dedicated utility-scale electricity generation projects. (Shared with governments and utility companies.)
• Support the construction of healthier and sustainable buildings (that is, buildings that utilize materials that are safe for humans and the environment, as well as easier to recycle) and possibly leverage existing resources.²⁰
• Understand and mitigate the adverse impact of cloud infrastructure creation and operation on local communities. (Shared with governments.)
• Leverage existing carbon emission reduction initiatives (for example, the Climate Neutral Data Centre Pact²¹ and the Transform to Net Zero Initiative²²).
• Commit to regular public reporting on key sustainability indicators, including energy and water consumption and progress toward sustainability targets.
• Whenever possible, encourage supply chain vendors to adopt similar sustainability principles/best practices.
• Share information and lessons learned on building a more sustainable cloud computing business and physical infrastructure.²³
• Create consultation requirements with local communities and evaluate existing adjudication mechanisms. (Shared with governments.)
• Encourage the transition to a more sustainable business through the use of internal carbon pricing.²⁴
• Integrate carbon reduction requirements into procurement policies.²⁵

Cloud Access Restrictions and Content Moderation

• Leverage best practices on transparency and accountability in restricting access and the development of content moderation tools.²⁶
• Refrain from restricting access or moderating content in ways that do not meet agreed-upon public standards/procedures.
• Implement “notice-and-comment” procedure before adopting/updating content moderation policies, practices, and technologies.
• Provide transparency into content moderation policies, as well as requests²⁷ and how providers comply with them, in every circumstance permitted by law (that is, via permanent/temporary removal of content/suspension of services).
• Establish a review process whereby customers and end-users can challenge content removal by providers, the ability to do so is clear, and the procedure thereof is straightforward.
• Agree to adopt and promote the use of explainable algorithms²⁸ in their products as well as to subject their content moderation offerings to algorithmic audits by independent, third-party corporate auditors.²⁹ (Shared with independent, third-party corporate auditors.)
• Publish regular algorithmic impact statements.³⁰
• Ensure developers of content moderation tools are trained on machine bias, diversity, inclusion, and equity issues.³¹

Ensuring a Beneficial and Safe Digital Environment for Groups with Special Requirements

• Establish clear policies and robust technical mechanisms that prevent, discourage, and penalize customers from utilizing cloud services for exploitation of vulnerable groups.
• Ensure consumer-facing enterprise customers, such as social media platforms, offer built-in protections for children and other vulnerable groups on their platforms.³² (Shared with enterprise customers.)
• Ensure that combatting exploitation minimally compromises user privacy or data encryption.
• Consider providing additional services at little or no cost to low-income individual users and certain emerging enterprises (for example, minority or woman-owned businesses).

Privacy Protections

• Set technical guardrails that discourage intrusions and continuously monitor/audit these protections for effectiveness.
• Create internal or engage external entities to investigate suspected breaches of user privacy.
• Provide robust technical mechanisms that allow customers to govern the collection and handling of their personal information.
• Clearly communicate to customers data collection, analysis, storage, and dissemination practices and policies; this can be in the form of easily accessible and digestible “principles.”³³
• Provide clear language on the allocation of responsibility between providers and customers for data privacy. (Shared with customers.)
• Ensure employees are well versed on corporate privacy principles and the pertinent laws and regulations.³⁴