This Recommendation clarifies the security responsibilities between cloud service providers (CSPs) and cloud service customers (CSCs), and analyses the requirements and categories of security metrics of operational security for cloud computing. It defines sets of detailed security measures and security activities for the daily operation and maintenance for cloud computing services and infrastructure from the perspective of CSPs, to fulfil the requirements of operational security for cloud computing.

This Recommendation will be helpful for CSPs to reduce operational risks. The target audiences of this Recommendation are CSPs, such as traditional telecommunication operators and Internet service providers (ISPs).