1.2.2 Organisational Standards

Organisational standards and specifications standards form a complementary pair. In a simplified view, we can argue that organisational standards are useful for structuring the internal processes of an organisation in order to best take accountability practices into account. By contrast, we can also argue that specification standards, by promoting interoperability, enable accountability across the provisioning chain with external entities. We will first discuss the role of organisational standards.

Organisational standards are not strictly necessary to enable accountability practices within an organisation. In theory, this goal can be achieved by applying best practices that have been developed internally. Such practices could notably be inspired by the A4Cloud conceptual framework [1]. This approach has some important drawbacks however. First, it makes it complex for external entities to evaluate the quality of the accountability practices implemented by the organisation. Second, it makes comparison between organisations largely impossible, since each organisation will be using its own logic and criteria. Standardised approaches solve these two problems by structuring practices in a way that is recognised not only within an organisation but also across the whole industry. In addition, such standards can be used as a foundation to build certification schemes, with independent third-party auditors, with the benefit of recognition and enhanced trust. This could create a market for accountability certification, much like existing information security management system (ISMS) certification today.

There are essentially two competing approaches to embed accountability into organisational standards:

1. Take existing standards in security, governance and compliance, identify their gaps regarding accountability and extend them if needed to cover these gaps.
2. Build a new "accountability management standard", mirroring ISO 27001 for security for example.

Both approaches have advantages and drawbacks.

Taking an existing organisational standard and extending it to cover accountability practices allows organisations to re-use a framework they already know. This normally minimises the cost of adding accountability to current practices, which in turn facilitates adoption of accountability practices. The Cloud Control Matrix ^[3] (CCM) is an example of an organisational cloud control framework that uses this attractive approach: all CCM controls reference back to existing equivalent controls in other frameworks in which they exist (in other words, to ISO/IEC 27001, PCI-DSS, ISACA COBIT, NIST, etc.). Using this approach for accountability means however that accountability is added to current practices and is not the backbone of the organisational practices. Building a real accountability organisational standard from scratch would allow describing governance, risk and compliance processes that would be structured around accountability. Building such a standard with industry consensus is however a huge task in itself.