SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA (American Institute of Certified Public Accountants). It is not government legislation or a certification scheme but a voluntary attestation standard — however, it has become a de facto market requirement for any technology company, cloud service provider, or SaaS vendor serving enterprise customers, particularly in the US. A SOC 2 report is produced by an independent CPA firm that evaluates an organization’s controls against the AICPA’s Trust Services Criteria (TSC), organized in five categories: Security (mandatory for all SOC 2 reports, covering Common Criteria CC1–CC9), Availability, Processing Integrity, Confidentiality, and Privacy (each optional depending on the organization’s services and customer commitments). The Common Criteria (CC1–CC9) are derived from the COSO Internal Control Framework and cover control environment, risk assessment, monitoring, logical/physical access, system operations, change management, and risk mitigation. There are two report types: Type I (evaluates control design at a point in time) and Type II (evaluates both design and operating effectiveness over 6–12 months — the standard enterprise customers demand). SOC 2 reports are restricted-use documents shared with customers under NDA. While not legally mandatory, major enterprises, financial institutions, and regulated industries routinely require SOC 2 Type II reports from their vendors before signing contracts, making it an essential market-access requirement for technology service providers.
Peer Pods is the deployment model for CoCo (Confidential Containers) designed for public cloud environments where the Kubernetes worker nodes are standard VMs — not bare metal — and therefore cannot host a nested confidential VM for each pod. The fundamental constraint it solves is physical: confidential computing hardware (TDX, SEV-SNP) does not support nested virtualisation, meaning a confidential guest cannot be launched inside another VM. In the conventional CoCo deployment, the Kata Containers runtime asks a local hypervisor (QEMU/KVM) on the worker node to create a micro-VM for each pod; if the worker node is itself a VM, this requires nested virtualisation that the TEE hardware cannot provide. Peer Pods sidestep this entirely by moving the pod’s VM off the worker node and onto a separate, cloud-provisioned instance running directly on bare-metal TEE-capable hardware.
The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program, codified into law by the FedRAMP Authorization Act of 2022, that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. FedRAMP is administered by the General Services Administration (GSA) and is mandatory — any cloud service (SaaS, PaaS, IaaS) that stores, processes, or transmits federal data or metadata must achieve FedRAMP authorization before it can be used by US government agencies or their contractors. The program defines three impact levels: Low (limited adverse effect), Moderate (serious adverse effect), and High (severe or catastrophic effect — applies to law enforcement, emergency, financial, and health systems). Each level maps to NIST SP 800-53 Rev 5 control baselines: FedRAMP High requires implementation of approximately 421 controls. Authorization is achieved through either an Agency ATO (a specific agency sponsors the assessment) or the newer FedRAMP 20-X experimental accelerated path. Once authorized, cloud service providers (CSPs) must maintain continuous monitoring — monthly vulnerability scans, annual penetration testing, and Plan of Action & Milestones (POA&M) reporting — or risk revocation. Authorized services are listed on the FedRAMP Marketplace.
The European Cybersecurity Certification Scheme for Cloud Services (EUCS) is a certification framework being developed under the 2019 EU Cybersecurity Act (CSA), led by ENISA. It is not yet adopted — the scheme has been in drafting since 2020 and remains stalled as of mid-2026 due to unresolved political disagreements over digital sovereignty requirements. EUCS is designed as an EU-wide, voluntary certification that would harmonize the fragmented national cloud certifications (such as France’s SecNumCloud or Germany’s C5) into three assurance levels: basic, substantial, and high. It applies to cloud service providers offering IaaS, PaaS, or SaaS on the European market. While EUCS is technically voluntary, its practical impact will be significant because the NIS2 Directive allows Member States to require entities in essential and important sectors to use only EUCS-certified cloud services. The core political controversy centers on whether the “high” assurance level should include sovereignty requirements — mandating EU headquarters, EU-only data processing, and immunity from non-EU extraterritorial laws (e.g. the US CLOUD Act). A March 2024 draft removed these requirements to achieve technical consensus, but the proposed recast of the Cybersecurity Act (CSA2), tabled in January 2026, would reinstate a formal sovereignty tier, with France leading advocacy for its inclusion.
Edge computing in telecommunications places compute, storage, and application execution close to users and devices — at cell sites, regional points of presence, or on-prem enterprise locations — rather than only in distant hyperscale data centres. The goal is to reduce end-to-end latency, limit backhaul load, satisfy data residency, and enable real-time applications (AR/VR, industrial control, V2X, video analytics) that are impractical with 50–100 ms round trips to central clouds. In 5G, edge is tightly coupled to the user plane: a local UPF on N6 breakout forwards traffic to an edge data network (DN) hosting MEC applications without hairpinning through the operator’s core hub.
A Confidential VM (CVM) is a virtual machine in which the guest’s memory contents, CPU register state, and execution flow are hardware-encrypted and isolated from everything outside it: the hypervisor, the host operating system, the cloud operator, other tenants, and anyone with physical access to the machine. The isolation is enforced not by software policy but by the CPU itself, using TEE technology — Intel TDX, AMD SEV-SNP, or Arm CCA — so that no amount of privilege on the host side grants access to the guest’s private state. A CVM is the VM-granularity equivalent of what SGX enclaves provide at the process level: the key difference is that a CVM requires no application changes, making it the practical path for lifting existing workloads into a confidential computing environment.
The BSI C5 (Cloud Computing Compliance Criteria Catalogue) is a German federal standard published by the BSI that defines minimum security requirements for cloud service providers. First released in 2016, the catalogue has undergone two major revisions: C5:2020 and the current C5:2026 (published 7 April 2026, replacing C5:2020). C5:2026 contains 168 criteria (up from 121 in C5:2020, a 39 % increase) structured across 17 domains aligned with ISO/IEC 27001 Annex A. The new version introduces a sub-criteria structure aligned with the European EUCS scheme, and adds five major new requirement areas: Confidential Computing (OPS-32/33: documented policies for Trusted Execution Environments and technical implementation of Remote Attestation), Container Management (OPS-34/35: lifecycle security for containerized workloads), Post-Quantum Cryptography (inventory of cryptographic assets and migration plan to quantum-resistant algorithms), AI transparency (disclosure of AI use in internal control systems), and Supply Chain Security (SBOM requirements, documented sub-processor audits). The catalogue is published in machine-readable YAML format for the first time. C5 is designed as an attestation standard (not a certification): providers undergo a Type 2 audit by an independent auditing firm (under IDW PS 880 or ISAE 3000), which verifies both the design and operational effectiveness of security controls over a period of at least six months. C5 is now effectively mandatory in two key domains: since 1 July 2025, cloud providers processing healthcare data must hold a valid C5 Type 2 attestation under §393 SGB V (Social Code, Fifth Book), and the revised BSI-KritisV (2024) requires KRITIS operators to use C5-attested cloud services in security-relevant contexts. Public-sector procurement in Germany also increasingly demands C5 attestation. C5:2026 becomes mandatory on 1 June 2027 for all audit periods starting on or after that date. During the transition: C5:2020 audits remain valid without additional requirements until 28 February 2027; between 28 February and 31 May 2027, C5:2020 is still permitted but requires a transition roadmap to C5:2026 in the system description.
SecNumCloud is a security qualification (“Visa de sécurité”) issued by ANSSI (Agence Nationale de la Sécurité des Systèmes d’Information), France’s national cybersecurity agency. Created in 2016 and currently in version 3.2 (published March 2022), it is the most demanding cloud security standard in France. SecNumCloud applies to cloud service providers offering IaaS, PaaS, SaaS, or CaaS (Container as a Service) and evaluates them against 354 requirements organized across 15 chapters (chapters 5–19) structured on ISO/IEC 27002:2013 Annex A (chapters 5–18: security policies, organization, HR security, asset management, access control, cryptography, physical security, operational security, communications security, system acquisition/development/maintenance, supplier relationships, incident management, business continuity, conformity) plus an additional chapter 19 with sovereignty-specific requirements (data localization, reversibility, and protection from extraterritorial law). The qualification is voluntary in principle — no law forces all cloud providers to obtain it — but it is effectively mandatory for providers serving French public administration, Opérateurs d’Importance Vitale (OIV), and entities handling sensitive government data, as French procurement policy (the “doctrine cloud de confiance”) requires the use of SecNumCloud-qualified providers. Version 3.2’s most significant addition is chapter 19.6, which mandates that qualified providers be headquartered in the EU, owned by European entities (individual non-EU shareholding ≤24 %, collective ≤39 %), and be immune from non-European extraterritorial legislation such as the US CLOUD Act or FISA. SecNumCloud is the model upon which France advocates for the “high+sovereignty” tier in the EU-wide EUCS scheme. Qualification is valid for 3 years with annual audits conducted by PASSI-accredited assessors.
