Towards Continuous Certification of Infrastructure-as-a-Service Using Low-Level Metrics

Continuous cloud service certification describes the process of continuously validating whether a service adheres to a set of requirements. However, most requirements derived from existing standards such as ISO-27001:2013 are generic, often times inherently ambiguous and thus cannot be validated automatically. In this paper, we address this gap by presenting a bottom-up approach using low-level metrics available through widely deployed implementations of infrastructure-as-a-service (IaaS) components. We further present examples how these low-level metrics can serve to construct complex metrics to support validation of generic requirements.