Cloud Concepts, Architecture and Design · Topic 2 of 5
Shared Considerations and Evaluating Cloud Providers
CCSP cloud shared considerations from portability to SLAs and auditability, plus how to evaluate a CSP with criteria, Common Criteria and FIPS 140.
- 5 min
- Portability is moving; interoperability is working together; reversibility is leaving cleanly.
- An SLA must define the metric, measurement, reporting and remedy.
- Evaluate providers against your own criteria using independent evidence, and check scope.
What it is
Cloud shared considerations are the cross-cutting qualities that matter whatever the service category or deployment model: can you move your data, will the service stay up, can you audit it, and who answers to the regulator. ISO/IEC 17789 calls them cross-cutting aspects.
Evaluating a cloud service provider means checking a real provider against those considerations and against your own requirements before you sign, using independent evidence rather than marketing claims.
How it works
The shared considerations
| Consideration | Question it answers |
|---|---|
| Interoperability | Can our systems and the provider's work together through standard interfaces? |
| Portability | Can we move data and applications to another provider or back in house? |
| Reversibility | Can we exit, retrieve all our data and have it deleted by the provider, within a set time? |
| Availability | Will the service be reachable when needed, and how is that measured? |
| Security | Are confidentiality, integrity and availability protected to our level? |
| Privacy | Is personal data handled lawfully, in permitted locations? |
| Resiliency | Can the service absorb failures and recover? |
| Performance | Are response times and throughput adequate and measured? |
| Governance | Who sets policy, approves changes and oversees the provider? |
| Maintenance and versioning | How are changes announced, and can we stay on a version long enough to test? |
| Service levels and SLAs | What is promised, how is it measured, and what happens when it is missed? |
| Auditability | Can we or an independent auditor obtain evidence that controls work? |
| Regulatory | Does the service let us meet the laws that apply to us? |
| Outsourcing | What risks come with handing a function to a third party? |
Portability comes in two forms: data portability (data can be exported in a usable format) and application portability (code runs elsewhere without a rewrite). Reversibility is the full exit: retrieval plus verified deletion at the provider.
Service level agreements
An SLA should define each metric precisely, the measurement method, the reporting cycle and the remedy. Service credits rarely cover the business loss of an outage, so the SLA is a measurement tool, not insurance.
Availability = (agreed service time - downtime) / agreed service time x 100
Example: 43,200 minutes in a 30 day month, 60 minutes down
(43,200 - 60) / 43,200 x 100 = 99.86%Verification against criteria
Evaluation starts with criteria taken from your requirements, risk appetite and regulations. Then you look for independent evidence that the provider meets them.
| Evidence | What it gives you |
|---|---|
| ISO/IEC 27001 certification | An audited information security management system; check the scope |
| ISO/IEC 27017 and 27018 | Cloud security controls and protection of PII in public clouds |
| SOC 2 Type 2 report | Auditor's opinion on control operation over a period |
| CSA STAR registry | Level 1 self-assessment, Level 2 third-party audit or certification |
| CSA CCM v4 | Control framework of 17 domains to map provider controls against your needs |
| PCI DSS attestation | Needed if cardholder data is in scope |
Always read the scope: a certification that covers one region or one service says nothing about the others.
Product certifications: Common Criteria and FIPS 140
Common Criteria (ISO/IEC 15408) evaluates a specific product, the target of evaluation, against a security target, often based on a protection profile. It assigns an Evaluation Assurance Level from EAL1 (functionally tested) to EAL7 (formally verified design and tested). A higher EAL means more rigorous evaluation, not more security features.
FIPS 140 validates cryptographic modules for US and Canadian government use under the Cryptographic Module Validation Program. FIPS 140-3 replaced FIPS 140-2 and aligns with ISO/IEC 19790. Both define four security levels:
| Level | Adds |
|---|---|
| 1 | Approved algorithms, production grade components |
| 2 | Tamper evidence, role based authentication |
| 3 | Tamper resistance and response, identity based authentication |
| 4 | Full envelope protection against environmental and physical attacks |
The outline example still names FIPS 140-2, and you may meet older modules validated under it. Treat a 140-3 validation as the current standard.
Product certifications cover a product in a tested configuration. A provider using a FIPS validated HSM still needs to run it in its validated mode, and that is a question for the provider's audit evidence.
A worked example
A bank shortlists two SaaS providers for customer onboarding. Both show ISO/IEC 27001 certificates. The architect reads the scope statements: provider A's covers its whole platform, provider B's covers only its headquarters office.
Provider A also supplies a SOC 2 Type 2 report and a STAR Level 2 entry, and stores encryption keys in HSMs validated to FIPS 140-3 Level 3. Provider B scores lower on verification, so the bank either selects A or makes further assurance a contract condition for B.
How the exam asks about this
- "Which consideration ensures a customer can leave a provider and have its data removed?" Reversibility.
- "What does an EAL rating under Common Criteria indicate?" The depth and rigour of evaluation, not the strength of security features.
- "A provider shows an ISO/IEC 27001 certificate. What should the customer check FIRST?" The certificate's scope covers the services being bought.
What to remember for the exam
- Portability is moving; interoperability is working together; reversibility is leaving cleanly.
- An SLA must define the metric, measurement, reporting and remedy.
- Evaluate providers against your own criteria using independent evidence, and check scope.
- Common Criteria rates assurance from EAL1 to EAL7 for a specific product configuration.
- FIPS 140-3 is the current US standard for cryptographic modules, with four levels.
A provider's certification does not transfer to the customer. The customer must still configure and use the service correctly and meet its own compliance duties.
Common mistakes
Trusting the logo. A badge on a website is not evidence; obtain the certificate or report and read its scope and period.
Treating service credits as compensation. Credits are usually a small share of fees and do not cover lost business.
Equating high EAL with best choice. A product with a high EAL in a configuration you will not use gives little assurance.
Check yourself
What is the difference between portability and interoperability?
Portability is the ability to move data or applications to another environment, while interoperability is the ability of systems to work together and exchange data.
What does FIPS 140-3 validate?
Cryptographic modules, at one of four security levels, for use by US and Canadian government agencies.
Why must the scope of a provider's certification be checked?
Because the certificate only covers the locations and services listed, which may not include the ones being purchased.
Topic 2 of 5 in Cloud Concepts, Architecture and Design
Test yourself on Cloud Concepts, Architecture and Design
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.