Verification of controls in information technology infrastructure via obligation assertion

摘要

A processing device comprises a processor coupled to a memory and implements an obligation management system for information technology infrastructure, with the obligation management system being configured to process a plurality of obligations on behalf of a relying party to verify implementation of corresponding controls in information technology infrastructure of a claimant. A given one of the obligations has an associated obligation fulfiller that is inserted or otherwise deployed as a component within the information technology infrastructure of the claimant and is configured to provide evidence of the implementation of one or more of the controls responsive to an obligation assertion so as to establish an associated trust aspect of the claimant. The information technology infrastructure may comprise distributed virtual infrastructure of a cloud service provider. The claimant may comprise the cloud service provider and the relying party may comprise a tenant of the cloud service provider.

主权项

1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory and implementing an obligation management system, the obligation management system being configured to process a plurality of obligations on behalf of a relying party to verify implementation of corresponding controls in information technology infrastructure of a claimant; wherein a given one of the obligations has an associated obligation fulfiller that is deployed as a component within the information technology infrastructure of the claimant and is configured to provide evidence of the implementation of one or more of the controls responsive to an obligation assertion so as to establish an associated trust aspect of the claimant; wherein the obligation fulfiller configures the evidence of the implementation of the one or more controls for delivery to the relying party responsive to the obligation assertion; and wherein the claimant comprises a cloud service provider and the relying party comprises a tenant of the cloud service provider.