Cloud Certification and Auditing

• Work with governments and cloud providers and customers to define high-level performance-based requirements and metrics for confidentiality, integrity, and availability of cloud services. These can differ based on the types of cloud service offered (such as storage and virtualization) and sectoral criticality. (Shared with governments and cloud providers.)

Incident Handling Procedures

• Proactively identify and define in contracts and/or SLAs roles in incident response and crisis communication vis a vis different cloud incident scenarios.¹ (Shared with cloud providers.)
• Collaborate in the development of standards to ensure confidentiality in sharing of sensitive incident information. (Shared with cloud providers and insurers.)
• Work with cloud providers, customers, insurers, credit rating agencies and pertinent regulators to determine appropriate disclosure constituencies, formats, and timing.² (Shared with governments, cloud providers, and insurers.)
• Enterprise customers: Understand and identify their critical functions and dependencies in order to inform adoption of a risk-based approach.
• Enterprise customers: Participate in incident response simulation exercises. (Shared with governments and cloud providers.)

Localization and Routing Requirements

• Enterprise Customers: Wish to retain the ability to move and keep data where they want it secure.³
• Seek robust protections against unauthorized access and invasion of privacy, which may occur through localization and routing requirements.

Security and Privacy in Lawful Government Access

• Enterprise customers: Publish, on a regular basis, transparency reports detailing aggregate statistics on government access requests (including requests received from foreign governments).⁴ (Shared with cloud providers.)
• Enterprise customers: Develop industry standards for challenging certain overbroad government access requests (such as requesting unfettered access, encryption keys, ability to break encryption). (Shared with cloud providers.)

Data Retrievability and Back-up Arrangements

• Enterprise customers: Configure a disaster recovery strategy for each application and service.⁵
• Enterprise customers: Regularly carry out drills to test disaster recovery plans.⁶ (Shared with cloud providers.)
• Enterprise customers: Consider alternatives to their primary cloud provider when procuring backup services, and consider the routine use of at least one additional cloud provider for regular operations.
• Enterprise customers: In addition to cloud-based backups, consider enabling on-premises backups for the most critical workloads.
• Enterprise customers: Consider incorporating disaster and data recovery strategies into contractual requirements (facilitated by industry’s development of guidance materials).
• Enterprise customers: Consider adopting practices compliant with international and other key information security standards (such as SOC 2⁷ and ISO27001⁸ ). (Shared with cloud providers.)

Government Intervention in Extremis

• Work with cloud providers or third-party insurers to ensure sensitive data is protected against potential abuse or mismanagement in the event of government intervention. (Shared with cloud providers.)
• Enterprise customers: Ensure they are insured against potential abuse or data mismanagement in cases of intervention. (Shared with cloud providers.)
• Enterprise customers: Participate in working groups between governments, providers, and enterprise customers to delineate clear “disaster level” thresholds for government takeover and eventual release. (Shared with governments and cloud providers.)
• Enterprise customers: Increase cooperation with governments and providers by participating in joint preparedness exercises. (Shared with governments and cloud providers.)

Insurance for Cloud Services ​

• Enterprise customers: Engage in efforts to map their evolving cloud dependency risks and collaborate with insurers to develop cloud insurance. (Shared with Insurers.)
• Enterprise customers: Help identify the conditions under which government backstopping mechanisms would take effect. (Shared with governments, cloud providers, and insurers.)

Portability and Interoperability

• Enterprise customers: Those that are unable or choose not to adopt a multi-cloud strategy should use interoperability and portability tools to ensure continuity of business.⁹
• Enterprise customers: Encourage the development, promulgation, and use of adaptation tools (possibly created by third-party vendors).
• Enterprise customers: Encourage agreement on common terminology and principles for portability and interoperability in consultation with governments and providers. Definitions for these terms have been formalized in standards, including SWIPO’s Codes of Conduct,¹⁰ IEEE’s P2301/P2302,¹¹ and ISO/IEC’s 19941.¹²

Commercialization of Customer Data

• Insist on fair and transparent arrangements on use of consumer/enterprise-derived data hosted on the cloud by cloud providers.
• Industry associations: Develop and publish model contracts that expand customer choice and bargaining power and restrict the purposes for which customer data may be used by providers.

Cloud Access Restrictions and Content Moderation

• Familiarize themselves with their data rights and protections against bias.
• Notify relevant public entities when suspected instances of bias in content moderation do occur.
• Consumer Customers: Use redress mechanisms made available by providers and government.
• Enterprise Customers: Solicit public feedback before adopting/updating content moderation policies, practices, and technologies.
• Enterprise Customers: Create internal review boards responsible for reviewing content moderation decisions.¹³
• Enterprise Customers: Ensure affected parties can challenge content removal, that the ability to do so is clear, and the procedure thereof is straightforward.
• Where possible and effective, use bargaining power (for example, threatening to move or stop using platforms or providers) to compel providers to be more transparent and accountable.
• Establish customer networks to facilitate discourse and disseminate information regarding changes in governmental and/or corporate policy and practices.

Ensuring a Beneficial and Safe Digital Environment for Children

• Enterprise customers: Establish clear policies that ensure enterprise operations do not (whether directly or indirectly) cause or facilitate harm or exploitation of vulnerable groups.
• Enterprise customers: Build technical protections for vulnerable groups into platforms (such as limits on recommendation algorithms, and special readable text for the differently-abled).¹⁴ (Shared with cloud providers.)
• Consumer customers: Ensure that children are engaging in safe digital environments by monitoring and appropriately curating content, using privacy controls and other restrictions, researching platforms, and so on.

Privacy Protections

• Adopt basic measures that prevent/discourage cyber intrusions (for example, frequently changing passwords, two-factor authentication limiting what information is made public or shared with providers, and so on).
• Enterprise Customers: Work with cloud service providers to ensure user identity and information are protected.
• Enterprise Customers: Provide clear language on the allocation of responsibility between providers and customers for data privacy. (Shared with Providers.)