Cloud Computing

A common question in cloud computing interview questions for freshers, don't miss this one.

Hybrid Clouds – Hybrid cloud combines the benefit of public and private clouds to reduce cost and distribute workload as per business demand. A hybrid cloud allows flow of data between private and public clouds in secure manner. It gives more flexibility and deployment option to the enterprise organizations.

Advantages Of Hybrid Cloud:

• Hybrid cloud combines the benefit of both private and public cloud
• It provides resource access to both internal and external users
• Hybrid cloud helps to modernize applications and processes incrementally as resources permit.

Disadvantages Of Hybrid Cloud:

• Hybrid cloud security management is a big challenge
• Standardization of rules and policies to govern infrastructure and data governance in hybrid cloud is difficult

Currently,lists as below:

• Infrastructure as a Service (IaaS) – Virtual or physical hardware resources (e.g. compute, storage, network) offered as a service. IaaS is provided using a shared, multi-tenant IT infrastructure through on-demand services. IaaS enables the end-user to provision servers, storage, networks, and other fundamental computing resources. End-users are able to deploy and run software, which can include operating systems and applications, on cloud-based servers. The end-user does not manage or control the underlying cloud infrastructure but has control over operating systems, data, deployed applications.
• Platform as a Service (PaaS) – delivers a computing platform or solution stack as a service, most often providing a complete development platform for organisations requiring a development instance of an application.
• Software as a Service (SaaS) – a hosted application accessed through a web browser. SaaS alleviates the maintenance and technical operation and support of business and consumer software. Management  or control the underlying cloud infrastructure including network, servers, operating systems, storage, application management is part of cloud SaaS provider. SaaS is offered with a subscription instead of traditional software license. The Pictorial representation is shown below:

The basic characteristics of Cloud computing mentioned below:

• Scalability: Infrastructure capacity scale up for traffic spikes in real time
• Resiliency: Cloud providers have mirrored images in more than one location to minimize downtime in the event of a disaster. This type of resiliency can give businesses the sustainability they need during unanticipated events.
• On-demand self-service: Self service portal allowing cloud end users to provision compute, network, storage and databases services any time any where without human intervention automatically.
• Broad network access: Cloud services are accessible over internet from any where any time. End users can connect to cloud services using laptop, tab or mobile phones over internet.
• Resource pooling: Foundation of Cloud service model is multi tenancy to enable sharing of resources amongst end users of different organization scattered over multiple region. Clients are free to choose compute, storage, network, database resources available at many location depending upon their business function. The cloud service provider Data centre is located all over the globe.
• Rapid elasticity: Resource provision to meet business function as per demand can be scale up and scale down rapidly and elastically as resource is available for usage appear to be unlimited and can be purchased in any quantity at any time.
• Measured Service: The services or resources used by users are measured correctly and displayed in dash board of cloud portal to enable users to track their consumption pattern against every resource and to keep a tab on cost on resource consumption.

Azure computing is virtualized environments backed by services provider hardware (Datacenter) to meet the on-demand resources like cloud computing, storage, web apps etc. by internet using pay as you go model. Cloud Computing is the delivery of services like server storage, networking services, WebApps, databases, analytics and intelligence etc. & it provides the innovation, resources flexibility.

Basically, we no need to set up a data centre for each and every service as cloud computing offers all of these services in virtualized environments which we can utilize and enable the services to meet the business requirements.

Azure Cloud computing the best examples are Azure Iaas, Paas & SaaS services and Azure cloud platform which provides all services like, Big data, Compute, Analytics, reporting services, Databases, Open sources etc. which will enable the faster solution with geographical availability than traditional services in this competitive world.

Microsoft Azure is a flexible, open and enterprise-grade cloud computing platform which is more fast, secure, trusted, intelligent and enable to hybrid environments.

MS Azure is Virtualized environments where we will access all the services and deployed without any hardware requirements and software license. It charges to pay as you go model. If I consume for 1 hr. it will charge for 1 hr. only.

• Deployment is faster.
• Pay as Go model
• Cost Saving
• Reliable and Scalable Environments.
• It’s secure and can manage securely.

Unsurprisingly, this one pops up often in cloud computing basic interview questions.

• Azure VMS: Azure backup will help you to take the backup of your azure VMS while enabling the Azure backup and retain the backup up to 30 days by default but you can increase up to 999 days/year/Months/Weeks as per customer requirements.
• Azure SQL DB on VMs: This feature will help you to take the backup of your SQL Database instance, which resides inside the VMs. This feature is in preview.
• Azure File storage:  It will help you to take the backup of azure file storage, If we have files stored in Azure file storage, than you can enable the backup from azure recovery vault to take the backup of Azure file storage.
• On-premise VMS: Azure backup will help you to take the backup of Azure on-premises VMS while setting up the Azure backup services in on-premises.

Azure load balancer works on layer 4 and distributes the traffic across the VMS. The load balancer is of 2 types, Internal load balancer which used to the internal application and external load balancer which used for external application. Let say if you have a web application running on a set of VMs and you want to load balance then internally or externally then you can utilize the Azure load balancer. You can configure the health prob and another rule for your web application. Even if you want to apply the NAT rules you can set up the same.

It will help your infrastructure and application to protect from DDoS attacks. It works in HTTPS load balancers to provide a defence of your infrastructure. We can allow/deny the rule for the same. Cloud Armor’s are flexible in rules language which enables the customization of defence and mitigate the attacks. Even it has predefined rules to defend against cross-site scripting (XSS) and SQL injection (SQLi) application-aware attacks. If you are running a web application then it will help you on protecting from SQL injection and DDos attacks and more based on the allow and deny rules you have configured.

Expect to come across this popular question in basic cloud computing interview questions.

VPC provides connectivity from your on-premise and across all regions without exposure to the internet. It Provides connectivity to computing virtual machine instances, Kubernetes Engine clusters, App Engine Flex instances, and other resources based on the projects. we can use multiple VPCs in various projects.

It’s associated with firewall rules and routes for global resources, not individual any specific regions. Even it is allowed to share the VPC for multiple projects.

Commonly used for the Google cloud platform and in a hybrid scenario.

Cloud Storage are used to store or retrieve the data worldwide. We can integrate into apps with a single API. It’s restful online storage for WebApps to store and access the data using google cloud platforms. It provides geo-redundancy with the highest level of availability and performance. Cloud storage has low-latency, high-QPS content serving to users distributed across geographic regions.

Common Use Case:

• Streaming videos and music
• Serving images and website content
• Mobile app development

It’s a Web framework which can be deployed in the Google cloud platform. We will deploy the google app engine, it’s fully managed the automatic engine and provide better security and reliability. it supports Java, PHP, Node.js, Python, C#, Net, Ruby and automatically scalable when traffic is more. It’s a highly available application which auto upgrade and downgrade the instance as per usage. We can manage the resources using the command line tools and debug the source code & run the API easily using DevOps tools like visual studio, PowerShell, SDK, cloud source repositories.

We can secure the application while using the App firewall and managing SSL/TLS certificates.

A common question in cloud computing questions and answers, don't miss this one.

Yes, you can replicate the S3 bucket data across the region. Bucket features allow you to copy the objects across different AWS regions.

It provides computing to AWS services, if you want to deploy a VMS then you need to use the EC2 instance and can deploy in any region. It’s a highly available and scalable instance in AWS to deploy heavy workloads in Amazon EC2 instance. Even it provides the paired key to secure the remote connection. EC2 instance used to deploy the application, SQL DB and any IaaS based application. Cost for the EC2 instance based on the VMS usage per second. Even you can use this kind of solution for a heavy workload.

Below is the storage I have used in my various projects.

• Amazon EBS: It provides the persistent block storage volume for VM instance to protect component failure and high availability.
• Amazon EC2 instance:  It provides the different types of instances, so we can choose the CPU, Memory and storage for VMS instance. It’s on-demand, spot instance and reserved instance in Amazon web services.
• Amazon S3: It’s secure, durable and highly scalable storage in AWS. It can be integrated with web application and can store a larger amount of data.

In lieu to the availability, it is the time duration the provider ensures your services are available, regardless of your cloud types (Public, Private, Community, or Hybrid) and service types (SaaS, PaaS, or IaaS). Commonly this metric is revealed with the percentage of uptime as its’ basis. Moreover, uptime is the amount of time the respective service is available and operationally online in a specific time interval. And so, if the uptime is 99.99% in a year, the total duration you will be unable to access the service, widely known as downtime, is no more than 52 minutes and 36 seconds in 12 months.

Availability of the services varies from one cloud to another cloud provider. Therefore, you need to know your availability requirements in the first place which includes but not limited to a business, mission-critical, time-critical system you have and your expected uptime/acceptable downtime.

Be mindful that the definition and measurement of availability are also different from one provider to another.

That’s said, upon the identification, search for the vendor with service availability that meets or, even more, exceeds your requirements. Ideally, you should choose the vendor that guarantees, not only publishes, their availability means that they will compensate your organization for missing the promised metrics and thresholds. Always take a look and learn their Service Level Agreement (SLA) carefully and thoroughly. Comprehend their policies, terms, conditions and provision of compensation in case of an outage in clauses

If you are keen to understand from a technical perspective, you might want to know how the provider manage the outage (unplanned downtime), their Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) and how they handle their maintenance (planned downtime) too.

By default, when you store, use, share or communicate your data in the cloud, usually, your data is in a raw, unencrypted format, known as ‘plaintext’, unless you have encrypted your data before being saved or transmitted.

If you leave your data unencrypted, you will face the risk that anyone who gains access to your account can read, copy or delete your data. This leaves your data leaked or exposed to unauthorized individuals and entities. Thus, end-to-end data encryption including your emails if stored in Cloud servers, at rest, in-use and in motion, is a must.

On the other hand, from the provider’s point-of-view, they will provide secure storage space and impose confidentiality obligations by limiting user access to those who are authorized to view, edit, add, delete the data based on your requests. What’s more, they will also protect the data from accidental or purposeful unauthorized access by internal or external actors.

Over and above that, you should gather the following information on data confidentiality policies, controls, practices, and technologies the provider has put in place:

1. Access

Whether the vendor provides various ways to securely access our data and services based on certain Access Control Matrix (ACM) constitutes of the users, groups,  permissions, privileges and credentials they offer.

1. Log Management

Whether the vendor provides log files to capture key activities occurring in our cloud environment so we will be able to monitor, analyze them and do follow up, for the purpose of an audit trail in particular.

1. Data ownership

Whether you as the customer maintain full control of your data and has the responsibility for managing your data, not only the provider’s services and resources. Ask for the guarantee that they do not access or use your data for any purpose without your consent. Even more, they don’t utilize your content or derive information for marketing or advertising.

1. Storage

Whether you could choose which region, country, or a city in which your data is  stored and what type of storage deployed. Ensure the provider ensure they don’t move, modify, add, delete or replicate your data without your prior consent.

1. Encryption

Encryption provided by the vendor: the type (at rest, in transit, in-use), the algorithm (Symmetric such as Advanced Encryption Standard (AES) or Asymmetric with the likes of Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC)), the encryption keys and the Key Management.

1. Exception

Whether the provider has any exception policy in intentionally disclosing our data to other parties usually due to a legal obligation, illegal conduct, and or binding order. If it happens, you need to know to whom your data is being unveiled, for what purpose and the provider needs to notify you prior to the disclosure.

As you might already be aware, data integrity, one of the key aspects in Information Security, means that the degree to which data is consistent, accurate and complete over its entire lifecycle.

To maintain it, you and the cloud provider must, hand-in-hand, provide such assurance.

First, assure the data cannot be modified by an unauthorized individual, entity, or program. This could happen by deploying Access Controls through Access Control Matrix (ACM) or Access Control List (ACL) revealing username, role, privilege, menu, function and object. The forensic tool may be also needed to recover from the accidental deletion by authorized users. In addition, implement also another control, checksum, to verify integrity.

Second, have data backup for occurrences like a power outage, database crash, storage failure. Given that the data is corrupted, try to identify the root cause then recover it in immediate. If it doesn’t go through, restore correct data from the backup. Regardless of the storage media utilized for the backup, always put it in separate logical or even better physical premise and location. A secure, confidential, safe one, obviously. Security policy, both logical and physical, applied to primary and backup data must be the same.

Third, implement algorithms and protocols namely Message-Digest algorithm 5 (MD5), Advanced Encryption Scheme (AES), Secure Hash Algorithm (SHA) and Rivest–Shamir–Adleman (RSA) to provide maximum levels of integrity management from any tampering or unauthorized access, specifically for data stored in the public cloud.

Fourth, getting data integrity verified through IT Audit activities. It could be possibly conducted by internal (from your side/provider end) or external entities (third-party/independent). As the 3rd layer of defence inside an organization, IT Auditor will be assessing, validating and testing IT General Controls and IT Application Controls as necessary to verify the consistency, accuracy and completeness of certain static as well as dynamic data.

In more general terms, data and information privacy is the rights you have on having various controls over how your data and information are managed across its entire lifecycle – when acquired, maintained, used, published, transferred, stored, archived and disposed.

Even though it looks quite similar with data and information security, in most cases these two definitions are found overlapped, they have a major difference to call to mind.

Privacy centre of attention is on how data and information are used and governed through certain policies, laws and regulations. On the contrary, the primary focal point of security is how data and information are protected from countless threats and vulnerabilities. In consequence, the last-mentioned isn’t adequate enough to deal with privacy.

What you could possibly do is collecting any information from the cloud provider as much as you could on:

1. Processes

How your data and information are processed in the cloud together with but not limited to where the provider is from, their head and in-country office, storage media, storage/server location, backup media and its location.

1. Control

How they enable users to have proper controls over their data and information across its lifecycle.

What are the controls – administrative, technical and physical – the provider deploys such as policy, procedure, mechanism, standard related to data and information privacy?

1. Guarantee

How they assure our data and information are appropriately managed and the compensation they bring into the table if the privacy is broken.

1. Responsible Party

The entity that is responsible for ensuring compliance to a certain standard, applicable law and regulation, along with regulatory requirements.

1. Third-Party

Whether there is any subcontractor involved in providing products and services to the cloud provider and to what extent this vendor involved in your data and information processing.

1. Standard and Framework

Standard and framework on data and information privacy the provider follow and comply with. You also need to know and understand their implications on your data and information privacy.

1. Law and Regulation

Law and regulation on data and information privacy the provider comply with. Be aware of similar law and regulation your country may have. Also acquainted with their implications and consequences.

1. Cross-Border

Identify the processes on how the provider deal with cross-border data transfer if we store and process our data in multiple sites across several geographical premises in a great number of countries.

Expect to come across this popular question in cloud computing scenario based questions.

Make sure you develop a business case in the first place that consists of a minimum of three options put into the spotlight and one recommendation. Those alternatives unveiled could possibly be, for instance, #1 public cloud, #2 private cloud, #3 hybrid cloud, #4 business as usual or do nothing – assuming what your organization needs is, for instance, Infrastructure as a Service (IaaS).

In detail, a business case is a written document typically containing material related to a new business or business improvement idea intended to convince the respected decision-makers to take any action. Into the bargain, it is aimed to justify the investment of resources and finances then obtain the stakeholder’s approval based on research, analysis and facts.

According to the commonly accepted industry practice, the business case shall constitute:

1. Executive Summary

A high-level view explaining the problem the proposed alternative is intended to solve, major considerations, desired deliverable, as well as the predicted business and financial aspects the recommendation shall achieve.

1. Problem/Opportunity Description

What problems to solve by implementing IaaS or what opportunity will your office rejoice the benefit from with IaaS deployment?

1. Solution Options

Four alternatives mentioned earlier are slated here.

1. Business Value Analysis

A structured approach in which we can compare the solutions for effective decision-making speaks volumes. Example: SWOT analysis, Real Options Decision Tree.

1. Cost-Benefit Analysis

An advanced level of analysis is needed to evaluate whether the solution being pursued is also financially viable e.g. Cost-Benefit Analysis/Ratio (CBA or CBR), Net Present Value (NPV), Internal Rate of Return (IRR), Return on Investment (ROI).

1. Risk and Mitigation

Identify risks of each option (public, private, hybrid, stay as is) and how to deal with them through mitigation activities.

1. Implementation Plan

Provides a realistic picture of how each proposed alternative will be rolled out in high-level point-of-view including its approach, timeframe, benefits, costs, and quality.

1. Assumptions and Dependencies

Assumptions should be validated and confirmed since the viability of alternative is dependent on them. The similar treatment goes to dependencies because they will become the prerequisites for a specific alternative/solution.

1. Recommendations

Disclose one from four alternatives that have been assessed with Business Value Analysis and Cost-Benefit Analysis as the recommended option.

Numerous success factors that should be thought about are:

1. IT Infrastructure

Start with development and testing environment first. Leave the production system and its configuration out to minimize the probability and more importantly impact of the concerns you may encounter.

1. Criticality

Choose to move the lowest time and mission-critical systems because if there is any incident, your organization’s business will suffer.

1. Complexity

Identify and migrate the systems with the simplest architecture as the action will be considered as low risk.

1. Usage

Assess your systems entirely then decide which one you are keen to migrate. Analyze minimum specifications, configurations and actual usage in various situations (high, medium, low workload). Upon completion, identify and choose the appropriate cloud environment to match, whenever and wherever possible, all your organization’s requirements.

1. Licensing

Be mindful of the licensing including the model and cost as well as Terms and Conditions of the cloud service (IaaS, SaaS, PaaS) and model (public, private, hybrid) you will procure ever since they differ from vendor to vendor and cloud service provider.

1. Service Level Agreement (SLA)

You should assess and evaluate SLA thoroughly including the compensation if the provider is unable to achieve the agreed metrics.

1. Security and Privacy
2. Integration

Ensure that you identify and discover application/system dependencies to avoid unplanned outages and limited functionality that usually occurs when the migration is completed.

1. Architecture

Review each architecture (Application, Data, Infrastructure) comprehensively to achieve optimization of the cloud platform.

1. Migration

Inquire about the processes, activities, methods, tools needed and or offered by the provider to migrate from their cloud into another cloud.

1. Network connectivity

Ask the provider on their network availability and bandwidth requirements because you and other end users will be accessing cloud services and products anywhere, any time.

In general, the cloud adoption activities should have a pre-adoption review, planning, execution, testing and post-adoption review to make sure things go well for you.

1. Pre-Adoption Review

• In the beginning, you could assess and analyze your IT organization overall readiness to complete this adoption job. Assure that you and your team have the expertise, resources, budget and time to do below items:
  • Roll out the cloud adoption project, while on the other hand, also doing IT operational activities
  • Fulfill all requirements
  • Deploy new processes as necessary
  • Architect the cloud to achieve metrics, objectives and goals
  • Operate and maintain your cloud services, products or resources
  • Review the migration project based on key success criteria

On condition that most of, or better, all the answers are yes, you could do this assignment alone. Otherwise, you could identify the adoption partner based on scores of measurements like the vendor’s capability, experience, resources, support, tools, portfolio and their client’s testimonials.

• Identify cloud adoption baseline metrics and Key Performance Indicators (KPI) namely page response time, database load time, availability, confidentiality, integrity (data completeness and accuracy), CPU utilization and memory usage.

Both metrics and KPI will help you to understand the current state of your IT environment and determine whether your adoption is successfully completed.

• Assuming your answer is the first, you could identify and select the right cloud services (type and model) and also the cloud provider that suits your organization and their requirements

1. Planning

Develop your cloud-adoption plan that accommodates the below factors:

• Determine the approach: short sprint vs big bang.
• Evaluate what to migrate (software, application, platform, infrastructure, data).
• Consider the architecture and dependency.
• Identify what to move first.
• Assess if there is any change in architecture needed.
• Analyze whether the migration will impact the performance.
• Discover how the new service will operate.
• Give thought to operational continuity.
• Prepare on how to deal with downtime.
• Recognize governance and compliance concerns.
• Make ourselves ready with audit and security issues.
• Work up with other risks.
• Techniques and tools utilized in the migration.
• Support (internal and external) during and after the migration.

1. Execution

In big-bang (do it all at once) scenario, it drives a huge change over a longer period of time as you move your entire computing components over and run a test to see if it works as expected. Presuming you take short-sprint (do it a little bit at a time) option, you migrate your computing component over, validating it then continuing these activities until all components are moved to the cloud.

1. Testing

You are urged to make sure everything is working by conducting the test. It could be manual or automated, based on plenty of scenarios, by capitalizing the previously agreed baseline metrics and KPIs as key success criteria.

1. Post-Adoption Review

It constitutes three main points: what went well (good things), what’s the room for improvement (bad things), and what’s the action plan (to improve the bad).

• CompTIA Cloud Essentials

Constitutes of basic understanding of cloud computing from both business and technical point of view, migration from on-premise to the cloud, also the governance of cloud computing environments. Issued by a non-profit, Information Technology trade association, the Computing Technology Industry Association (CompTIA). No prerequisite required; nevertheless, the examinee is recommended to have six months of working experience in IT services environment at the minimum.

• CompTIA Cloud+

Slightly different from Cloud Essentials, it validates your skills in maintaining and optimizing cloud infrastructure services. Consequently, it will assess our competence to perform data centre jobs effectively and efficiently such as configuration, deployment, security, troubleshooting, maintenance and management.

• EXIN Cloud Computing Foundation

Offered by an independent exam and certification company EXIN, it covers cloud computing basic concepts and principles, tests the technical knowledge namely Security and Compliance as well as looks at general aspects inclusive of implementation, management, and evaluation.

• CCC Cloud Technology Associate

For those who are relatively new to cloud computing, this credential is assessing your basic knowledge of Cloud Computing concepts. Developed by joint forces between EXIN and an international member-based organization Cloud Credential Council (CCC), it tests your understanding of the main concepts of Cloud Services Model, Virtualization, Cloud Technologies and Applications, Security, Risk, Compliance, Governance, Adoption, and Service Management.

• AWS Certified Solutions Architect – Associate

This Amazon Web Services (AWS) Certified Solution Architect’s accreditation is divided into two paths: Associate and Professional. The first is aimed to assess the individual knowledge in architecting and deploying secure, robust systems on AWS while, on the one hand, it’s also a prerequisite to achieving the professional certification. In the second place, it also validates your ability to define solutions based on customer/end-user requirements using architectural design principles and provides implementation guidance to your organization based on best practices throughout the Project Life Cycle.

• AWS Certified Solutions Architect – Professional

What’s more, the professional path targets individuals with two or more years of hands-on experience in designing and deploying cloud architecture and architecting and implementing dynamically scalable, highly available, fault-tolerant, and reliable applications on AWS. It also validates the exam taker’s competence in migrating complex, multi-tier applications on the platform, designing and deploying enterprise-wide scalable operations and implementing cost-control strategies.

• Google Cloud Certified – Professional Cloud Architect

As a professional Cloud Architect, you are expected to have the necessary skills and knowledge to enable your organization to leverage Google Cloud technologies. By securing this testament, your ability to design, plan, develop, implement, manage and provision robust, secure, scalable, highly available and reliable cloud architecture using Google Cloud Platform (GCP) along with dynamic solutions to drive business objectives is recognized.

It's no surprise that this one pops up often in interview questions about cloud computing.

To date, many ISO standards have been applied to the cloud. Taking out the expired and withdrawn versions, here is the list:

• ISO/IEC 17788:2014

Information Technology -- Cloud computing – Overview and vocabulary

• ISO/IEC 17789:2014

Information Technology -- Cloud computing -- Reference architecture

• ISO/IEC 17826:2016

Information Technology -- Cloud Data Management Interface (CDMI)

• ISO/IEC 19086-1:2016

Information Technology -- Cloud computing -- Service level agreement (SLA) framework -- Part 1: Overview and concepts

• ISO/IEC 19086-2:2018

Cloud computing -- Service level agreement (SLA) framework -- Part 2: Metric model

• ISO/IEC 19086-3:2017

Information Technology -- Cloud computing -- Service level agreement (SLA) framework -- Part 3: Core conformance requirements

• ISO/IEC 19086-4:2019

Cloud computing -- Service level agreement (SLA) framework -- Part 4: Components of security and of protection of PII (Personally Identifiable Information)

• ISO/IEC 19099:2014

Information Technology -- Virtualization Management Specification

• ISO/IEC 19831:2015

Cloud Infrastructure Management Interface (CIMI) Model and RESTful HTTP-based Protocol -- An Interface for Managing Cloud Infrastructure

• ISO/IEC 19941:2017

Information Technology -- Cloud computing -- Interoperability and portability

• ISO/IEC 19944:2017

Information Technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use

• ISO/IEC TR 22678:2019

Information Technology -- Cloud computing -- Guidance for policy development

• ISO/IEC TR 23186:2018

Information Technology -- Cloud computing -- Framework of trust for processing of multi-sourced data

• ISO/IEC 27017:2015

Information Technology -- Security techniques -- Code of practice for information security controls based on ISO/IEC 27002 for cloud services

• ISO/IEC 27018:2019

Information Technology -- Security techniques -- Code of practice for protection of PII in public clouds acting as PII processors

Like any other ISO standards, conforming to them has many benefits for the provider’s businesses: building credibility at the international level, saving time and money by identifying and solving recurring problems, and improving and enhancing the system and process efficiency and effectiveness. On top of that, it is also living proof, publicly accessible, that the provider has properly managed their information security, including its risk, fulfilled their audit requirements and established trust both internally and externally that controls are properly placed and implemented in order to serve their customers better and hence increase their satisfaction level.

You, as the user, are urged to assess their ISO certification. Critical points to reflect on are: which product, service, or location does it actually cover? Is the certification for the entire organization or only for their head office exclusive of their branches? Who issues the certification and whether the issuer is one of the ISO-accredited bodies? For certain, you must see the original certificate and witness what information revealed there.