Standards, attestations and government programs for cloud service providers and the companies that build on them: FedRAMP, ISO/IEC 27017 and 27018, CSA STAR, BSI C5 and more.
Cloud security compliance has two sides. Cloud service providers (including SaaS companies) must show customers how they secure the platform. Customers must still secure what they put on it. Every cloud standard draws that line, usually called the shared responsibility model, and much of the work is making it explicit in contracts and documentation.
What this category covers
ISO/IEC 27017 adds cloud-specific security guidance to ISO/IEC 27002, and ISO/IEC 27018 covers the protection of personal data by public cloud processors. Both are normally assessed as part of an ISO/IEC 27001 certification. The Cloud Security Alliance's STAR program uses its Cloud Controls Matrix for self-assessment and third-party assurance. Germany's BSI C5 is an attestation that German public bodies and many enterprises ask for. Government programs decide whether a cloud service can be used by a public body: FedRAMP for US federal agencies, GovRAMP for US states and local government, and MeitY empanelment in India.
Mandatory or voluntary
The ISO standards and CSA STAR are voluntary. The government programs are required only if you want to sell to that government, and for those customers they are not optional. Some, such as FedRAMP, are changing their process: the FedRAMP guide covers the current program rules and the move to FedRAMP 20x.
For SaaS teams
Most of the evidence these programs ask for comes from engineering: infrastructure as code, logging, vulnerability management, encryption key handling, tenant isolation and a tested backup and restore. Designing for those from the start makes every later assessment cheaper.
Germany, with growing use across Europe. Required by German federal administration and, by law, for cloud processing of health data in the German healthcare system.
Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany's Federal Office for Information Security
European Union. Applies to manufacturers and data holders of connected products and related services placed on the EU market, cloud and edge providers serving EU customers, and others, wherever they are established.
European Parliament and Council; enforced by national competent authorities and data coordinators
Cloud Computing Compliance Criteria Catalogue (C5) of the German Federal Office for Information Security (BSI)
BSI C5 is the German Federal Office for Information Security's catalogue of minimum security requirements for cloud services. Independent auditors test a provider against the criteria and issue an attestation report, much like a SOC 2 report, which customers use to assess the service. C5 is expected by German public bodies and enterprises and is legally required for cloud processing of health data in the German healthcare system. A new version, C5:2026, adds criteria on areas such as key management, confidential computing and post-quantum cryptography.
Cloud Security Alliance Security, Trust, Assurance and Risk (STAR) program and Cloud Controls Matrix (CCM)
CSA STAR is the Cloud Security Alliance's assurance program for cloud services. It is built on the Cloud Controls Matrix, a cloud-specific control framework of 17 domains, and the Consensus Assessments Initiative Questionnaire. Providers can publish a free self-assessment (Level 1) in the public STAR Registry or obtain independent assurance (Level 2) by combining the matrix with ISO/IEC 27001 certification or a SOC 2 attestation. The matrix moved to version 4.1 in 2026, and STAR for AI extends the program to AI services.
FedRAMP is the US government program that standardises security assessment of cloud services used by federal agencies. A cloud service offering must obtain FedRAMP certification, based on NIST SP 800-53 controls and assessment by an accredited third party, before agencies rely on it. In 2026 the program adopted Consolidated Rules, renamed authorizations to certifications, replaced Low, Moderate and High impact levels with certification classes, and began moving all providers from the Rev5 process to the automation-based FedRAMP 20x.
GovRAMP (StateRAMP doing business as GovRAMP), the cloud security verification programme for US state and local government
GovRAMP, originally launched as StateRAMP in 2020, is a nonprofit programme that verifies the security of cloud products sold to US state and local governments. Based on NIST SP 800-53 Rev. 5 and FedRAMP baselines, it lets providers be verified once and serve many governments. Providers can start with a Security Snapshot, move to Core status covering 60 priority controls, and progress to Ready, Provisionally Authorized or Authorized with independent assessment and continuous monitoring. FedRAMP-assessed products can use a fast track.
ISO/IEC 27017 Information security controls for cloud services (code of practice based on ISO/IEC 27002)
ISO/IEC 27017 is the international code of practice for information security in cloud computing. It adds cloud-specific guidance to the ISO/IEC 27002 controls for both cloud service providers and cloud service customers, and defines extra controls for issues unique to the cloud, such as shared roles, segregation of virtual environments and removal of customer assets. Its second edition, published in 2026, aligns it with ISO/IEC 27002:2022. It is voluntary and assessed alongside ISO/IEC 27001.
ISO/IEC 27018 Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27018 is the international code of practice for public cloud providers that process personal data on behalf of their customers. It adds privacy-focused guidance and controls to the ISO/IEC 27002 security controls, covering processing only on customer instructions, no use of personal data for the provider's own purposes without consent, transparency about sub-processors and data locations, breach notification, and return or deletion of data. The 2025 third edition aligns it with the 2022 controls.
MeitY empanelment of cloud service offerings under the MeghRaj (GI Cloud) initiative, with STQC audit
MeitY cloud empanelment is the Government of India's approval of cloud service offerings for use by government and public sector bodies. Under the MeghRaj (GI Cloud) initiative, providers are audited by STQC or empanelled auditors against standards for security, interoperability, data portability, service levels and contract terms, with services hosted in India. Government departments procure from empanelled offerings, and regulators such as SEBI reference empanelment for regulated entities.
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)
The EU Data Act gives users of connected products, such as smart devices, vehicles and industrial machines, the right to access and share the data their use generates, and requires manufacturers to design products so data is accessible. It also makes switching between cloud providers easier, bans unfair data contract terms imposed on businesses, lets public bodies request data in exceptional need, protects non-personal data from unlawful foreign access, and sets interoperability rules. It has applied since 12 September 2025.
IT disaster recovery planning: how standards and laws expect RTO, RPO, backups and recovery testing
IT disaster recovery planning makes sure the systems and data a business depends on can be restored within agreed times after outages, cyberattacks or disasters. Standards and laws describe it differently but expect the same core elements: a business impact analysis, recovery time and point objectives, protected backups, redundant infrastructure, written recovery procedures, regular tests and improvement. This guide compares what ISO, NIST, SOC 2, HIPAA, DORA, RBI and SEBI expect, and how to build a plan that satisfies them together.
System and Organization Controls 2: report on controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy
SOC 2 is an attestation report in which an independent CPA firm gives an opinion on a service organisation's controls against the AICPA Trust Services Criteria: security, and optionally availability, processing integrity, confidentiality and privacy. A Type I report covers the design of controls at one date; a Type II report also tests whether they operated effectively over a period. It is voluntary, but it is the security evidence US enterprise buyers ask SaaS and IT vendors for most often.
No. FedRAMP is for cloud services used by US federal agencies. Private companies more often ask for SOC 2 or ISO/IEC 27001.
Can you be certified to ISO/IEC 27017 on its own?
ISO/IEC 27017 is a code of practice, so it is normally assessed as an extension of an ISO/IEC 27001 certification rather than as a standalone certificate.
Is our cloud provider's certification enough for us?
No. It covers the provider's part of the shared responsibility model. Your configuration, access control, application and data remain your responsibility.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
