A cloud-based Hardware Security Module (HSM) is a key management service offered by a cloud provider such as AWS, GCP, Microsoft Azure, etc. It provides hardware-backed cryptographic key generation, storage, and signing within the cloud provider’s infrastructure. Unlike traditional on-premises HSMs that the entity physically owns and controls, cloud-based HSMs stay within the cloud provider’s data centers under a shared responsibility model.
CCSS™ is technology neutral and does not distinguish between on-premises and cloud based HSMs. The same requirements apply regardless of where the HSM is hosted. Since the cloud HSM is part of the entity’s CCSS Trusted Environment, the controls surrounding it must meet the applicable requirements at the entity’s target certification level.
The cloud provider is responsible for maintaining the properties of an HSM which make it viable to be used in cryptocurrency systems. The entity is responsible for the configurations, Identity and Access Management (IAM) policies, network level controls, logging and monitoring of interactions with the cloud HSM and other operational procedures that govern how the cloud HSM is used. Additionally, a CCSSA will rely on the third-party vendor due-diligence and risk assessment conducted by the entity before integrating the cloud provider as a part of the key management system.