ISO/IEC 19086-3:2017

INTERNATIONAL ISO/IEC
STANDARD 19086-3
First edition
2017-07
Information technology — Cloud
computing — Service level agreement
(SLA) framework —
Part 3:
Core conformance requirements
Technologies de l’information — Informatique en nuage — Cadre de
travail de l’accord du niveau de service —
Partie 3: Exigences de conformité essentielles
Reference number
©
ISO/IEC 2017
© ISO/IEC 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2017 – All rights reserved

Contents Page
Foreword .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 1
5 Conformance . 2
6 Relationship between the cloud service agreement and cloud SLAs .2
7 Cloud SLA Management . 2
8 Role of cloud service level objectives, cloud service qualitative objectives, metrics,
remedies, and exceptions in the cloud SLA . 2
9 Cloud SLA components . 3
9.1 General . 3
9.2 Covered services component . 3
9.3 Cloud SLA definitions component . 3
9.4 Service monitoring component . 3
9.4.1 General. 3
9.4.2 Monitoring parameters . 3
9.4.3 Monitoring mechanisms . . 3
9.5 Roles and responsibilities component . 3
10 Cloud SLA content areas and their components . 4
10.1 General . 4
10.2 Accessibility content area . 4
10.2.1 Accessibility component . 4
10.2.2 Accessibility standards . 4
10.2.3 Accessibility policies . . . 4
10.3 Availability content area . 4
10.3.1 Availability component . 4
10.3.2 Availability. 4
10.4 Cloud service performance content area . 4
10.4.1 General. 4
10.4.2 Cloud service response time component . 4
10.4.3 Cloud service capacity component. 5
10.4.4 Elasticity component . . 5
10.5 Protection of personally identifiable information (PII) content area. 6
10.6 Information security content area . 6
10.7 Termination of service content area . 6
10.7.1 Termination of service component . 6
10.7.2 Data retention period . 6
10.7.3 Log retention period . 6
10.7.4 Notification of service termination . 6
10.7.5 Return of assets . 6
10.8 Cloud service support content area . 7
10.8.1 Cloud service support component . 7
10.8.2 Support hours . . 7
10.8.3 Service incident support hours . 7
10.8.4 Service incident notification time . 7
10.8.5 Maximum first response time . 7
10.8.6 Maximum incident resolution time . 7
10.8.7 Support plans . 7
10.8.8 Support methods . 7
10.8.9 Support contacts . 7
© ISO/IEC 2017 – All rights reserved iii

10.8.10 Service incident reporting . 7
10.8.11 Service incident notification . 8
10.9 Governance content area . . 8
10.9.1 Governance component . 8
10.9.2 Regulation adherence . 8
10.9.3 Standards adherence . 8
10.9.4 Policy adherence . 8
10.9.5 Audit schedule . 8
10.10 Changes to the cloud service features and functionality content area . 8
10.10.1 Changes to the cloud service features and functionality component . 8
10.10.2 Minimum service change notification period . 8
10.10.3 Minimum time before feature/function deprecation . . 9
10.10.4 Service change notification method . 9
10.11 Service reliability content area . 9
10.11.1 General. 9
10.11.2 Service resilience/fault tolerance component . 9
10.11.3 Customer data backup and restore component .10
10.11.4 Disaster recovery component.11
10.12 Data management content area .11
10.12.1 Intellectual property rights (IPR) component .11
10.12.2 Cloud service customer data component .11
10.12.3 Cloud service provider data component .11
10.12.4 Account data component .12
10.12.5 Derived data component .12
10.12.6 Data portability component .12
10.12.7 Data deletion component .12
10.12.8 Data location component.13
10.12.9 Data examination com
...