Cloud Service Trustworthiness Assessment Based on Cloud Controls Matrix

Cloud computing has been widely adopted by corporate and individual customers due to its resource-sharing model that allows on-demand access to scalable and high performance computing services. The growth of such services means there are a lot of service providers who can provide similar services, and hence quality attributes of the services become the criteria for cloud service selection. This paper focuses on cloud service trustworthiness that embraces both security and dependability attributes. A trustworthiness assessment method is proposed based on the CSA Cloud Controls Matrix security guidelines that are mapped to NIST SP800-53 security and privacy recommendations and AICPA trust services principles and criteria in order to classify security and dependability characteristics of each control. Based on the mapping, the provision capabilities of a cloud service as listed in the CSA Consensus Assessments Initiative Questionnaire are assessed and the trustworthiness score of the service is calculated. The assessment method then can assist service consumers in determining and comparing trustworthiness of candidate cloud services as one factor to consider in the service selection process.