| NOTAS: | A study prepared for the European Commission DG Communications Networks, Content & Technology by Fundación Tecnalia Research & Innovation
"A newly published study analyses existing security certification schemes for cloud computing, and asks why they have not been more widely adopted. It also sets out the minimum requirements that an EU-wide certification scheme in cloud computing would need to cover. The study concludes that the market for cloud computing certification schemes in the EU is highly fragmented: different initiatives have arisen at different levels, international standardisation organisations and European member states have launched their own public and public-private initiatives, with varying levels of success. The study analyses six certification schemes in depth, with the aim of comparing the key areas on which each focuses, such as procurement management, operational security, and security integrity. The study uses these findings to suggest requirements for the minimum aspects that would need to be covered by an EU-wide cloud computing certification scheme, covering categories such as procedures and policies, business continuity, operational security, assets management, incident management, security assessment and more. The study puts its findings into the context of EU policies related to cloud computing and security certification, such as the Digital Single Market, the Directive on security of network and information systems (NIS Directive), the Cybersecurity Act and the Free Flow of non-personal Data." |
