ISO/IEC 19086-1

ISO/IEC 19086-1:2016 establishes a set of common building blocks (concepts, terms, definitions, contexts) that can be used to create Cloud Service Agreements including Service Level Agreements (SLA). It is part 1 of the 4 part ISO/IEC 19086 series.

ISO/IEC 19086-1:2016 covers the following:

  1. an overview of cloud service agreements
  2. identification of the relationship between the cloud service agreement and the cloud SLA
  3. concepts that can be used to build cloud service agreements
  4. commonly used terms

The standard is for the benefit and use of both cloud service providers and cloud service customers. The aim is to avoid confusion and facilitate a common understanding between cloud service providers and cloud service customers. Cloud service agreements and their associated cloud SLAs vary between cloud service providers, and in some cases, different cloud service customers can negotiate different contract terms with the same cloud service provider for the same cloud service.

The standard provides a set of cloud service level objectives (SLOs) and cloud service qualitative objectives (SQOs) that may apply to cloud services or cloud service providers. This approach provides flexibility for cloud service providers and customers in tailoring their cloud service agreement.

Benefits

  • ISO/IEC 19086-1 enables a vetted move to the cloud by providing risk and compliance stakeholders a framework for due diligence. Compliance considerations can be more reliably accounted for
  • ISO/IEC 19086-1 provides standardized terminology, including SLOs and SQOs, that cloud service providers and cloud service providers can reference in their negotiations and agreements
  • ISO/IEC 19086-1 provides references to other standards that can be useful in the development of cloud service agreements

Implementation

The Cloud Services Due Diligence Checklist, based on ISO/IEC 19086-1:2016, is a tool that can be used in the due diligence process when procuring cloud services and when negotiating cloud service agreements.

Structure

Forward

Introduction

  1. Scope
  2. Normative Reference
  3. Terms and Definitions
  4. Symbols and Abbreviations
  5. Overview of Service Level Agreement for cloud service
  6. Relationship between the cloud service agreement and the cloud SLAs
  7. Cloud SLA management best practices
    1. General
    2. Design
    3. Evaluation and acceptance
    4. Implementation and execution
    5. Change to Cloud SLA
  8. The role of cloud service level objectives, cloud service qualitative objectives, metrics, remedies and exceptions in the cloud SLA
    1. General
    2. Metrics
    3. Service Level Objectives and Service Qualitative Objectives
      1. Service Levels
      2. Cloud service level objectives
      3. Cloud service qualitative objectives
    4. Remedies and claims
      1. Remedies
      2. Claims process
    5. Exceptions
  9. Cloud SLA components
    1. General
    2. Covered services component
      1. Description
      2. Relevance
    3. Cloud SLA definitions component
      1. Description
      2. Relevance
    4. Service monitoring component
      1. Description
      2. Relevance
      3. Cloud service qualitative objectives
    5. Roles and responsibilities component
      1. Description
      2. Relevance
  10. Cloud SLA content areas and their components
    1. General
    2. Accessibility content area
      1. Accessibility component
    3. Availability content area
      1. Availability component
    4. Cloud service performance content area
      1. General
      2. Cloud service response time component
      3. Cloud service capacity component
      4. Elasticity component
    5. Protection of personally identifiable information (PII) content area
      1. Protection of PII component
    6. Information Security content area
      1. Information Security component
    7. Termination of service content area
      1. Termination of service component
    8. Cloud service support content area
      1. Cloud service support component
    9. Governance content area
      1. Governance component
    10. Changes to the cloud service features and functionality content area
      1. Changes to the cloud service features and functionality component
    11. Service reliability content area
      1. General
      2. Service resilience/fault tolerance component
      3. Customer data backup and restore component
      4. Disaster recovery component
    12. Data management content area
      1. General
      2. Intellectual property rights (IPR) component
      3. Cloud service customer data component
      4. Cloud service provider data component
      5. Account data component
      6. Derived Data component
      7. Data portability component
      8. Data deletion component
      9. Data location component
      10. Data examination component
      11. Law enforcement access component
    13. Attestations, certifications and audits content area
      1. Attestations, certifications and audits component

Bibliography

ISO/IEC 19086 Series

ISO/IEC 19086 consists of the following four parts, under the general title Information technology – Cloud computing – Service Level Agreement (SLA) framework:

Part 1 : Overview and concepts: Focus on Cloud Service Agreement and Cloud Service Level agreement - released September 2016

Part 2: Metric Model: Defines a Metrics Model - under development

Part 3: Core requirements - under development

Part 4: Security & Privacy - under development

ISO/IEC 19086 builds on the cloud computing concepts defined in ISO/IEC 17788 and ISO/IEC 17789. It establishes a common framework for helping organization understand the purpose of all parts of ISO/IEC 19086 and the relationships between those parts. It identifies other documents that have relationships with ISO/IEC 19086 and which are useful in understanding cloud SLAs.

ISO/IEC 19086-1, 19086-2 and 19086-3 are being developed by sub-committee 38 (SC 38) of the Joint Technical Committee (JTC 1) of the International Organization for Standardization and the International Electrotechnical Commission. 19086-4 is being developed by sub-committee 27 (SC27).