EDCA-P04 · Governed by EDCA-STD-04
Cloud Security Certification
An assessment of cloud and hosted infrastructure, covering configuration baselines, tenancy separation, network controls, secrets management and recovery capability.
Scope of assessment
The scope is agreed in writing before the assessment begins and is printed on the certificate. A certificate says nothing outside its scope.
- Production cloud accounts, projects or subscriptions
- Network architecture and exposure to public networks
- Infrastructure provisioning and configuration management
- Backup, replication and recovery arrangements
What is examined
Each area below is assessed against the requirements of EDCA-STD-04, Cloud and Infrastructure Security, version 1.3.
- Cloud governance and shared responsibility understanding
- Environment and tenant segregation
- Network controls and public exposure
- Configuration baselines and drift detection
- Secrets, key and credential management
- Recovery objectives and demonstrated capability
Programme particulars
- Programme code
- EDCA-P04
- Governing standard
- EDCA-STD-04 — Cloud and Infrastructure Security, version 1.3, issued 20 April 2026
- Levels available
-
Level II — EDCA Security Verified
Level III — EDCA Advanced Compliance
Level IV — EDCA Trusted Technology - Typical duration
- Eight to twelve weeks from application to decision.
- Surveillance
- As required by the level held. See level requirements.
Evidence normally requested
The list is indicative. The evidence request issued after the preliminary assessment is specific to the agreed scope.
- Infrastructure diagrams and account structure
- Configuration baselines or infrastructure-as-code repositories
- Network and firewall rule exports
- Secrets management configuration
- Recovery test records against stated objectives
Apply for Cloud Security Certification
Submitting an application costs nothing and commits you to nothing. The Agency will confirm eligibility, propose a scope and issue a fee schedule before any assessment work begins.