Overview
ISO/IEC TR 22678:2019 - Information technology - Cloud computing - Guidance for policy development provides practical guidance on using international standards as a tool for developing policies that govern cloud service providers (CSPs), cloud services, and organizational cloud usage. The technical report explains core cloud concepts, the implications of cloud scale and multi-jurisdiction deployments, and how standards can inform regulatory, advisory and procurement policy. It cites ISO/IEC standards where available and other WTO-registered standards bodies when needed (note: it informs policy design but does not address trade measures).
Key topics
The document focuses on topics that matter to policy makers and IT decision-makers:
- Cloud fundamentals: standard definition and essential characteristics (from ISO/IEC 17788), benefits to customers and society.
- Policy implications: shared responsibilities, multi-jurisdiction deployments, data classification, geographical restrictions, and exceptional circumstances.
- Operational impacts: continuous development, service scale/velocity, and multi-tenancy risks.
- Trust, transparency and compliance: guidance on certification, audit, conformity assessment, and transparency frameworks.
- Interoperability and portability: considerations to avoid vendor lock-in and support cross-provider mobility.
- Security and privacy: high-level considerations for risk management, data protection and governance.
- SME adoption: challenges and considerations for supporting small and medium enterprises.
- Policy types covered: regulatory, advisory and procurement-specific considerations (terminology, SLAs, supplier certifications, network connectivity).
Applications (who uses it)
ISO/IEC TR 22678:2019 is intended for:
- Government policy makers and regulators drafting cloud governance, regulatory frameworks or sector-specific rules.
- Public-sector procurement officers creating cloud procurement requirements and evaluation criteria.
- Enterprise IT governance, legal and compliance teams aligning internal cloud policies with international standards.
- Cloud architects and CSPs seeking to understand policy expectations related to interoperability, security, SLAs and data localization.
- SMEs and industry associations looking for guidance to adopt standards-based cloud services responsibly.
Practical uses include developing policy instruments, shaping procurement specifications, mapping standards to legal and regulatory requirements, defining shared responsibility models, and designing certification or audit programs.
Related standards
The report references and aligns with other relevant standards, notably:
- ISO/IEC 17788 (cloud overview and vocabulary)
- ISO/IEC 19086 series (service level agreements, transparency/trust aspects)
- ISO/IEC 19944 (data concepts in cloud)
- ISO/IEC 27552 (privacy information management)
It also points to other WTO-registered standards where ISO/IEC documents are not available.
Keywords: ISO/IEC TR 22678:2019, cloud computing, policy development, cloud standards, CSP, interoperability, portability, trust, transparency, cloud procurement, cloud regulatory guidance.