IT Compliance Hub

Cloud Security

What cloud and SaaS providers need to show their customers and governments: FedRAMP, GovRAMP, CSA STAR, ISO 27017 and 27018, Germany's C5, and the EU Data Act's cloud switching rules.

  • 3 guides in this area
  • Mandatory and voluntary clearly labelled
  • Official sources in every guide
Where to start

Which one do you need?

Find the line that matches your situation. Many companies need more than one; the guides explain how they overlap.

If this is youStart withType
You sell cloud services to US federal agenciesFedRAMP Government authorization / contract requirement
All guides

Cloud Security guides

Government authorization / contract requirement USA

FedRAMP

Federal Risk and Authorization Management Program

FedRAMP is the US government programme that assesses and authorises cloud services for use by federal agencies. Any cloud service that holds federal information generally needs it. In 2026 FedRAMP moved from its document-heavy Rev5 process to the 20x approach with Consolidated Rules, certification classes A to D and more automated, evidence-based validation. The rules become mandatory on 1 January 2027, and existing Rev5 authorizations sunset at the end of 2028.

Mandatory: Required for cloud services used by US federal agencies

Quick facts
What it covers
Security assessment, authorization and continuous monitoring of cloud products and services used by US federal agencies.
Who needs it
Cloud and SaaS providers selling to US federal agencies
Why it matters
Without FedRAMP, a cloud or SaaS company can't sell to most US federal agencies, and many state, local and defence buyers use it as a benchmark.
Key requirements
  • Meet the security requirements of the applicable class or baseline (built on NIST SP 800-53)
  • Independent assessment, traditionally by an accredited 3PAO
  • Machine-readable, reusable evidence under 20x
  • Continuous monitoring, vulnerability detection and response
  • Marketplace listing and agency use
  • Adopt the Consolidated Rules by the applicable deadlines
Where it applies
USA (federal)
Category
Cloud Security
Read the FedRAMP guide

Also relevant to cloud security

Certifiable standard Global

ISO 27001

ISO/IEC 27001: Information security management systems. Requirements

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is voluntary, but enterprise customers and tenders often require it. You build a risk-based system that meets clauses 4 to 10, choose controls from the 93 in Annex A, and an accredited certification body audits you. The certificate lasts three years, with yearly surveillance audits.

Voluntary: Voluntary, often required by customers

Quick facts
What it covers
Information security risk management, governance, people, physical and technical controls, supplier security, incident handling and continual improvement.
Who needs it
SaaS, IT services, BPO, any firm selling to enterprises
Why it matters
It is the security certificate customers ask for most often outside the US, and it gives independent proof that security is managed, not improvised.
Key requirements
  • Define the ISMS scope and context (clauses 4.1 to 4.4)
  • Leadership commitment, an information security policy and assigned roles
  • Risk assessment and risk treatment, with a Statement of Applicability
  • Controls chosen from the 93 in Annex A, with exclusions justified
  • Competence, awareness and documented information
  • Monitoring, internal audit and management review
  • Corrective action and continual improvement
Where it applies
Global
Category
Information Security
Read the ISO 27001 guide
Independent attestation USA, Global

SOC 2

System and Organization Controls 2 (AICPA SOC for Service Organizations: Trust Services Criteria)

SOC 2 is an attestation report in which an independent CPA firm gives its opinion on a service organisation's controls, measured against the AICPA Trust Services Criteria. It is voluntary, but US enterprise customers routinely ask SaaS and IT vendors for it. A Type 1 report covers control design at a point in time; a Type 2 report also tests how the controls operated over a period, usually 3 to 12 months.

Voluntary: Voluntary, often required by customers

Quick facts
What it covers
Controls over security (always included) and, if chosen, availability, processing integrity, confidentiality and privacy of the systems used to serve customers.
Who needs it
B2B SaaS, cloud hosting, managed service providers
Why it matters
It is the most requested security report in US vendor reviews, and it replaces many long security questionnaires with one independent report.
Key requirements
  • Security (Common Criteria CC1 to CC9) is always in scope
  • Optional categories: availability, processing integrity, confidentiality, privacy
  • A system description written by management
  • Controls designed to meet each applicable criterion
  • Type 2 only - evidence that controls operated throughout the review period
  • Audit by a licensed CPA firm under AICPA attestation standards
Where it applies
US origin, used globally
Category
Information Security
Read the SOC 2 guide
Other areas

More IT compliance categories

Information Security Data Privacy & Protection Cybersecurity IT Governance & Risk Management Secure Software Development Payment & Financial Data Security Healthcare IT AI Governance & Compliance Business Continuity & Disaster Recovery International IT Regulations Indian IT Laws & Regulations All IT compliance guides
IT compliance help

Not sure which cloud security rules apply to you?

Tell us what you build, where your customers are and what they ask for. We reply with suggested next steps.

  • No obligation
  • NDA on request
  • Reply within one business day
Prefer to talk first? Book a call WhatsApp iamvishavjeet@gmail.com

Get an IT compliance assessment

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Need a custom Tutor LMS solution?

Tell us what you are building or what is broken. A Tutor LMS developer reads every inquiry and replies with next steps and a free estimate.

Get a free consultation Book a call

Get a free Tutor LMS consultation

Tell us what you are building or fixing. A Tutor LMS developer replies with honest advice and next steps.

  • No obligation
  • Tutor LMS and Pro specialists
  • Your details stay private

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.