The EMERALD approach can be summarized as follows:
- Different controls from one or more certification schemes are selected, which are a comprehensive set of rules, technical requirements, standards and procedures with which to demonstrate compliance.
- An intelligent system selects an optimized set of metrics that can be measured to demonstrate compliance to the controls. One such optimization could be the maximum amount of re-used evidence across schemes.
- EMERALD components continuously extract knowledge on various layers of the cloud service(infrastructure, code, policies and procedures, AI models) and prepare suitable evidence based on them.
- A graph-based structure (the certification graph) consolidates all necessary information of the service in a uniform way and makes it ready for queries.
- The audit suite assesses and evaluates chosen metrics based on information provided by the certification graph while providing interoperability to other assessment tools (e.g., based on OSCAL) during the whole life-cycle of the cloud service.
With EMERALD, we expect to significantly decrease the time needed to re-certify, select and evaluate new cloud-based services and to facilitate the integration of new services that are not on premise but offered by different and also smaller providers.
