Cloud Service Provider Evaluation

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified Cloud Security Professional premium course — no separate purchase.

Included in this chapter:

What CSP evaluation actually asks
Organizational attestations: SOC, ISO, and CSA STAR
Assurance depth: self-attestation versus third-party audit
Product certifications: Common Criteria and FIPS 140-2/3
Exam-pattern recognition

Which assurance artifact answers which question

Artifact	Assurance layer	What it proves	Who verifies it
SOC 2 (Type I / II)	Organizational attestation	Trust Services Criteria controls designed (I) or operating over a period (II)	Licensed CPA firm (AICPA SSAE 18)
ISO/IEC 27001	Organizational attestation	A certified information security management system (ISMS) exists and is maintained	Accredited certification body
ISO/IEC 27017 / 27018	Organizational attestation	Cloud-specific controls (27017) and cloud PII protection (27018) on top of 27001	Accredited certification body
CSA STAR (L1 / L2)	Organizational attestation	CCM/CAIQ-mapped controls: self-assessed (L1) or third-party audited (L2)	Provider (L1) or accredited assessor (L2)
Common Criteria (EAL)	Product / system certification	A product meets a security target at an Evaluation Assurance Level	Accredited evaluation lab under a CC scheme
FIPS 140-2 / 140-3	Product / system certification	A cryptographic module is validated at a security level (1-4)	NIST CMVP accredited lab
PCI DSS	Regulatory / industry mandate	Controls protecting cardholder data are in place for the assessed scope	QSA (or self-assessment via SAQ for small merchants)

Decision tree

Cheat sheet

Evaluate a provider on independent evidence, not its own claims
Match the assurance artifact to the layer your question lives in
Who verified the claim is the sharpest axis on any artifact
SOC 2 is the security report; SOC 1 is for financial reporting
SOC 2 Type II beats Type I because it tests controls over time
SOC 3 is a public summary with no detailed test results
ISO/IEC 27001 certifies a managed ISMS, not a single control
ISO/IEC 27017 is cloud controls; 27018 is cloud PII protection
CSA STAR has two levels: self-assessment, then third-party audit
CCM is the control framework, CAIQ the questionnaire, STAR the registry
Use CSA STAR and CAIQ to screen many providers against one control set
Common Criteria's EAL measures evaluation rigor, not absolute security
FIPS 140-2/3 validates cryptographic modules at four security levels
An HSM for high-value keys typically targets FIPS 140-2/3 Level 3
FIPS 140-3 is the current standard, superseding 140-2
Confirm a crypto module runs in its validated FIPS-approved mode
Match a regulated workload to its specific mandate, then check scope
PCI DSS allows a self-assessment path or a QSA audit by volume
An attestation covers a fixed scope and a past window, not forever
A provider's attestation never discharges the customer's own duty
SLA service credits are usually the sole, capped remedy, not damages
Judge an SLA by actual historical uptime, not just the stated percentage
FedRAMP High is for severe-or-catastrophic-impact data and is continuously monitored
ISO/IEC 27036 is the supplier-relationship and supply-chain security standard
Under GDPR Article 28 a CSP needs controller consent for subprocessors and stays liable

Unlock with Premium — includes all practice exams and the complete study guide.

Cloud Service Provider Evaluation

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Which assurance artifact answers which question

Decision tree

Cheat sheet

Also tested in

References