At the end of October 2015, the Cloud-Select Industry Group held its annual plenary meeting in Brussels. This unique gathering is an important touching point between the European Commission and key industry bodies within the cloud computing sector.
The meeting allowed Commission officials, cloud service providers and industry thought leaders to take stock of recent European-level initiatives to support cloud services and uptake.
Most of C-SIG’s work takes place within three main working groups. Together, they provide the Commission with industry insights and recommendations around issues, such as service level agreements (SLAs), certification schemes and the development of an industry-wide, data protection code of conduct.
So what has C-SIG and its subgroups been up to over the past year or so?
Certification
In collaboration with the EU Agency for Network and Information Security (ENISA), the C-SIG subgroup on security certification published a dynamic Cloud Certification Schemes List (CCSL) and Meta-Framework (CCSM).
CCSL gives an overview of all the different existing certification schemes that could be relevant for cloud computing customers. It has been designed to help service providers choose the best scheme for their requirements and customers.
CCSM, first published towards the end of last year, goes a step further. It maps security requirements for cloud-based services from the national governments of 11 countries based on publicly available material. An online procurement tool guides SMEs and the public sector through various security options to ‘go cloud’.
SLAs
The C-SIG subgroup on SLAs has developed an SLA checklist and guidelines on standardisation. Under the Digital Single Market (DSM) umbrella, this subgroup will need to decide whether to contribute to international standardisation efforts in this area, for example ISO/IEC NP 19086-4 (Information technology / Cloud computing / SLA framework and Technology / Part 4: Security and privacy). The group continues to gather views from cloud service providers and ISPs on the subtleties of SLA negotiations and how they can be used to drive uptake of cloud services.
Code of conduct
Over the past two years, the C-SIG code of conduct subgroup has worked closely with industry and the European Commission to develop a consensus for conduct concerning data protection for cloud service providers. This code is now in its final stages of development.
In September 2015, the Article 29 Data Protection Working Party (29WP) published an official opinion on the draft code of conduct. 29WP was set up under the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
The opinion is an open invitation to industry to revise and finalise the code of conduct. The final version is in sight following a number of proposed revisions from 29WP, including:
- Stronger compliance with data protection laws
- Inclusion of forthcoming provisions under the General Data Protection Regulation (GDPR) that are not part of Directive 95/46/EC or national laws (e.g. issues around liability or data portability)
- A clear statement that the code does not replace the law, nor affect the competencies of national data protection authorities
- More robust governance structures
- A mechanism to enable cloud users to verify a provider’s compliance with data protection rules
The subgroup is currently working to produce the final draft of the code, as well as discussing mechanisms to ensure it evolves in line with legislation as well as technological and market developments.
The future of C-SIG
The subtle shift in the EU’s cloud priorities since the launch of the Digital Single Market (DSM) updates and extends the work of C-SIG, which is recognised by the Commission and industry players as an important forum for addressing key and emerging issues in the area of cloud computing.
A restructuring may be necessary to align the group’s work with the pillars of DSM, for it to continue to provide an interface between policy-makers and the cloud computing sector. In particular, the code of conduct subgroup will press ahead to address the 29WP comments, with a view to finalising the code and developing a programme for industry-wide acceptance and adoption.
Also from the plenary session...
- Preliminary results presented from Deloitte's commissioned study 'Measuring The Economic Impact of Cloud Computing in Europe'
- Discussions to identify which elements of the Digital Single Market Strategy are most relevant to cloud computing
- An introduction to the European Open Science cloud initiative
- Update on the European Free Flow of Data initiative
More information
Article 29 Data Protection Working Party
Cloud computing working groups
Read Trusted Cloud Europe, final report of the European Cloud Partnership
Last update
9 March 2021