If you happen to exist in Europe and come under some stringent mandates,
like GDPR, it could be helpful to evaluate your cloud service provider by
means of EuroCloud. EuroCloud has a StarAudit program that is an
independent nonprofit organization with an international network of
accredited partners and professionals.
It's designed to facilitate the growth of cloud‑based services and the
corresponding innovations on a global perspective.
StarAudit has these five activity areas,
awareness programs, data privacy compliance,
knowledge transfer, start up encouragement, standards and
interoperability between cloud service platforms, and the idea of
having a harmonization of legal frameworks, which is something that
is true of the European union, the harmonization of law. When a
StarAudit certification is carried out,
it is a two‑way trust between consumer and provider, and the assessments are
done in such a way that they provide accountable quality capabilities to see
transparently into the cloud service provider's control.
There's also a need to make sure that your professionals,
IT, legal, and procurement, all have a certain level of
training and competency necessary to carry out their
responsibility for managing cloud services.
When we look at the StarAudit Assessment Tool,
it is designed so that there can be self‑assessments by the cloud service
providers that they could do compliance checks that exist outside of their
self‑assessment, gap analysis for bringing on new services, there being
changes in laws and regulations, comparing vendors for the cloud consumer,
making sure that there's a checklist for the development of new information,
and also the auditing capabilities that would be necessary to provide
assurance for consumers.
Their vision is to create tools that deliver the framework,
the assessment, and the certification in a trustworthy way.
They also want to make sure that they're reducing the need for
costly individual assessments and having a resource space so
that it can be used repeatedly.
From a transparency perspective, they're verifying that they have a high
level of openness for customers and providers alike,
and then they want to make sure that they enable an efficient process for
transferring knowledge based off of accrediting different parties,
be the contractual,
sub‑contractual, insurance, and other types of information
necessary for protection in the cloud.
Finally,
let's consider what we should be thinking about if our
audit process turns into forms of testing.