OSS compliance certifications-Object Storage Service(OSS)-阿里云帮助中心

Object Storage Service (OSS) holds multiple compliance certifications to help you meet a wide range of requirements.

Compliance certification	Description
Cohasset Associates audit certification	OSS is audited by Cohasset Associates. It meets strict requirements for electronic record retention. These requirements include SEC Rule 17a-4(f), FINRA 4511, and CFTC 1.31. For more information, see OSSCohassetAssessmentReport.
ISO 9001	ISO 9001 specifies requirements for a quality management system. This standard applies when an organization: Wants to demonstrate that its products and services meet customer expectations and applicable legal and regulatory requirements. Aims to enhance customer satisfaction by applying the system. This includes processes for system improvement and ensuring compliance with legal and regulatory requirements.
ISO 20000	ISO 20000 is the standard for a service management system (SMS). It specifies requirements for a service provider (SP) to plan, establish, implement, operate, monitor, review, maintain, and improve the SMS.
ISO 22301	ISO 22301 is a business continuity management system. It helps organizations create an integrated management process plan. The standard helps organizations identify potential problems and threats. It provides an effective management mechanism to prevent or counter these threats and reduce loss.
ISO/IEC 27001	ISO/IEC 27701 provides guidance for protecting privacy information. It adds requirements to establish, implement, maintain, and continuously improve privacy information management (PIM) within the scope of an Information Security Management System (ISMS). This reduces risks to privacy information.
ISO 27017	ISO 27017 provides guidelines for information security controls for using cloud services. It includes: Additional implementation guidance for controls related to ISO/IEC 27002. Additional controls and implementation guidance related to the attributes of cloud services.
ISO 27018	ISO 27018 establishes a code of practice for protecting personal privacy. It includes control objectives, controls, and implementation guidelines. It specifies requirements for protecting personally identifiable information (PII) based on the information security risk environment identified in ISO/IEC 27002.
ISO 29151	ISO 29151 provides practical guidelines for organizations to protect personal privacy, reduce compliance risk, and meet requirements identified by risk assessments related to protecting PII.
BS 10012	The BS 10012 standard helps organizations provide valid evidence of their compliance with the GDPR. The standard uses a personal information management system that follows best practices. It helps organizations ensure the proper use of personal information while respecting privacy rights. For more information, see the official BS 10012 website.
CSA STAR	The Cloud Security Alliance Security, Trust, Assurance and Risk (CSA STAR) certification builds on the ISO/IEC 27001 certification. It uses a maturity model and assessment methods from BSI to evaluate an organization's cloud security management and technical abilities. The result is an independent, third-party audit conclusion. For more information, see the official CSA STAR website.
PCI DSS	The Payment Card Industry Data Security Standard (PCI DSS) is a key certification for payment card services. It assesses the security of payment card data, such as credit card numbers and CVV2 numbers. It also focuses on the security of transmitting and storing account numbers and passwords. The PCI Data Security Standard helps protect data. It establishes business and technical requirements for organizations that accept or process payment transactions. It also sets requirements for software developers and manufacturers of applications and devices used in these transactions. For more information, see the official PCI DSS website.
C5	Alibaba Cloud follows the C5 standard. This shows a commitment to the highest compliance for control and security in cloud computing. C5 is mainly for professional cloud service providers, their auditors, and their customers. It has 17 control requirements. Cloud providers must comply with these requirements or meet a defined minimum standard. The assessment is necessary for working with the German public sector. It is also increasingly used by the private sector. The idea behind C5 is to unify the currently fragmented cloud computing certifications. For more information, see the C5 standard.
MTCS	The Singapore certification body, Certification International, has issued Alibaba Cloud with the highest security rating, T3, for the Singapore Multi-Tier Cloud Security (MTCS) standard. The MTCS standard was initiated by the Infocomm Development Authority (IDA) of Singapore and launched by the Standards, Productivity and Innovation Board (SPRING Singapore). It is a cloud security standard. The security certification has three levels. Level 3 is the highest and most secure.
GxP	GxP is a general term for a set of regulations in the life sciences industry. It includes Good Manufacturing Practice (GMP), Good Storage Practice (GSP), and Good Laboratory Practice (GLP). OSS meets GxP compliance requirements by obtaining independent, third-party certifications. These certifications include ISO 9001, ISO 27017, ISO 27001, and ISO 27018.
TPN	The Trusted Partner Network (TPN) is a joint venture between the Motion Picture Association of America (MPAA) and the Content Delivery & Security Association (CDSA). TPN aims to help companies secure content. It works to prevent leaks, piracy, and hacking of movies and TV shows before their release. It does this by creating a single, global directory of trusted partner vendors. TPN confirms that service providers use industry best practices. It ensures that certified and experienced assessors have verified the security of the provider's facilities, staff, and workflows. For more information, see the official TPN website.
Trusted Cloud Service Assessment	The Trusted Cloud Service Assessment is an assessment for cloud computing services. It is tested and evaluated by the China Academy of Information and Communications Technology (CAICT) under the guidance of the Ministry of Industry and Information Technology (MIIT). The assessment aims to create an evaluation system for cloud services. It helps users choose trusted and secure cloud services. This promotes the healthy and orderly development of the cloud computing market. Alibaba Cloud was one of the first cloud service providers to pass the Trusted Cloud Service Assessment.
SOC 1/2/3 reports	Alibaba Cloud System and Organization Controls (SOC) reports are independent audit reports. They are issued by third-party auditors who examine and verify the cloud services that Alibaba Cloud provides to customers. The reports describe Alibaba Cloud's key controls and their objectives. This helps customers and their auditors evaluate Alibaba Cloud's internal controls and manage outsourcing risks.