{"id":6306,"date":"2020-10-20T08:00:37","date_gmt":"2020-10-20T07:00:37","guid":{"rendered":"https:\/\/lcloud.pl\/?p=6306"},"modified":"2024-12-10T12:55:36","modified_gmt":"2024-12-10T11:55:36","slug":"accreditation-models-for-cloud-adoption","status":"publish","type":"post","link":"https:\/\/lcloud.pl\/en\/accreditation-models-for-cloud-adoption\/","title":{"rendered":"Accreditation models for cloud adoption"},"content":{"rendered":"

Safety during the cloud adoption process is one of the key issues for organizations (both in the public and private sectors) that decide to move their business to the cloud. To dispel doubts that may arise in the decision-making process, AWS has prepared special, helpful documentation related to accreditation models – <\/span>Accreditation Models for Secure Cloud Adoption<\/span><\/span><\/a><\/span>. Thus, it provides a set of best practices in the field of accreditation, taking into account security in commercial data processing in the cloud.\u00a0<\/span><\/span><\/h4>\n

\"\"<\/p>\n

 <\/p>\n

The evaluation of cloud services offers can be a considerable challenge, especially for public institutions. It is influenced by the organizational model of a given administrative unit.<\/span><\/p>\n

The organizational model is a structured structure (institutional or bureaucratic) that aims to support and implement accreditation programs. And this, in turn, is related to certificates and approvals widely used in the world, such as ISO, SOC 3 or PCI, which by definition consist of 80% of security requirements.<\/span><\/p>\n

The whitepaper prepared by AWS refers to 3 models in which the key is to define who determines and approves the risk profile during adoption to the cloud. The developed models are adapted to international requirements.\u00a0<\/span><\/p>\n

Decentralized model<\/b><\/span><\/h4>\n

It was prepared on the basis of the British model, which allows for an individual approach of each public sector department or agency, flexibility in assessing and adjusting the risk model related to the activity or organizational requirements. Thanks to the possibility of prioritizing selected goals, there is a chance to delegate responsibility for the risk to a given accredited entity. Such flexibility allows for faster adoption of new solutions. However, it may be associated with increased costs and the need to have qualified teams that will be responsible for authorizing decisions related to the selection of a cloud service provider.<\/span><\/p>\n

\"\"<\/p>\n

Centralized model<\/b><\/span><\/h4>\n

The model is used by Singapore and Germany. It standardizes the security accreditation processes in the entire administrative unit. Decisions are made at the headquarters of the unit, in accordance with a set set of criteria related to ensuring the highest possible levels of security for the entire organization. Such a decision-making process can be quite time-consuming, but in the long run, once approved cloud services can be used by all departments within a given unit. A model related to the publication and maintenance of standards by the headquarters of the government unit and certification by the cloud provider of the required accreditation. No formal evaluation or government approval is required.<\/span><\/span><\/p>\n

Hybrid model<\/b><\/span><\/h4>\n

It combines the attributes of the two previously mentioned models. The FedRAMP (US Federal Risk and Authorization Management) model is a hybrid that includes two paths: the decentralized path (agency authorization) and the centralized Joint Authorization Board (JAB) path. In the hybrid model, the resources required to reach consensus among multiple decision-makers also add to the burden. It is related to guidelines prepared by state authorities and decisions concerning risk assessment.<\/span><\/p>\n

Ultimately – the cloud adoption process depends on many factors specific to each situation. Therefore, it is worth getting acquainted with the best practices that will help you apply the right model, which are described in detail in Accreditation Models fo Secure Cloud Adoption<\/a><\/span>.<\/span><\/strong><\/p>\n

 <\/p>\n

\"\"<\/a>In the context of the Polish IT market and the criterion of safe adoption to cloud computing, it is worth mentioning the <\/span>Cloud Computing Cybersecurity Standards (SCCO)<\/span><\/a><\/span>. It is a document developed as part of the collection of Narodowe\u00a0 Standardy Cyberbezpiecze\u0144stwa, referred to in the Polish National Cyber Security Strategy\u00a0for 2019-2024. It aims to:<\/span><\/span><\/p>\n