SLIDE 4 CSP Self-Disclosure Checklist
Criteria Measures / Disclosure Requirements Right to audit Ability to conduct own reviews (e.g., site assessment, penetration test) & costs Compliance List of compliance statuses Data ownership Data ownership limitations Data retention Periods for user data, user log data, and infrastructure log data Data sovereignty Data locations, capability to restrict geographies, and DR locations Information non-disclosure What if any information may be disclosed Availability Mean time between failures; service availability BCP / DR Recovery point objective; Recovery time objective Liability Limits in-case of incidents/failure to meet service commitment Change Management Comms plan and procedures for managing changes On-demand self-service* Users can unilaterally provision computing capabilities as needed automatically without requiring human interaction with CSPs
* Five essential characteristics of Cloud Computing as defined by NIST
CSP Self-Disclosure Checklist
Criteria Measures / Disclosure Requirements Incident & problem management Support provided (e.g., notification, cooperation with outside parties) Billing (Measured Svc) Metrics & accuracy Data portability Mechanisms supported including media and format upon termination Access to CSP’s network Methods to access the provider (e.g., Internet IPV4/6, site-to-site VPN, frame relay) User management Options for integrating with customer IDM, 2-factor solutions Lifecycle Automatic or customisable service upgrades and changes Security configuration enforcement checks Mechanism to enforce check on security configuration Multi-tenancy Tenancy options Capacity elasticity Peak load handling capabilities for capacity Network resiliency & elasticity Peak load handling capabilities for network Storage redundancy & elasticity Peak load handling capabilities for storage
Deployment Considerations
- 1. Deployment
- Incorporate MTCS as a requirement into Public Cloud Services bulk tender
3 rounds of training sessions for CSPs, CBs and SaaS ISVs have been conducted
- 2. Cross-Certification schemes with other standards (ISO 27001) to
facilitate easy migration to MTCS SS - WIP
- 3. Working with Singapore Accreditation Council (SAC) to provide
accreditation services to Certification Bodies
- 4. Establishment of a website to capture CSP certification & self-
disclosure info to promote TRUST building through TRANSPARENCY MTCS Certification Scheme (1/2)
- 1. URL: http://www.ida.gov.sg/collaboration-and-initiatives/initiatives/for-infocomm-
enterprises/MTCS-Certification-Scheme
- 2. Scope
- 3 different levels of security certification (tiers 1, 2 & 3) & further qualified with types
- f services (IaaS, PaaS & SaaS)
Example: “Company X is certified to supply Infrastructure-as-a-Service at Tier level 2 according to MTCS standard (SS584 : 2013)”
- 3. Validity
- Certification will be valid for 3 years with a yearly surveillance audit to be conducted.
