Secure tenant assessment of information technology infrastructure

An apparatus comprising:

• information technology infrastructure comprising:
• a computing environment shared by multiple tenants of a service provider;
• a secure assessment environment separate from the computing environment;
• an evidence collection module associated with the shared computing environment and configured to collect compliance evidence from the shared computing environment and to make the collected compliance evidence available to the secure assessment environment for storage therein;
• and
• a tenant assessment interface to the secure assessment environment configured to receive assessment requests from the multiple tenants and through which the multiple tenants can access the compliance evidence as stored in the secure assessment environment in a manner that does not undermine security of the shared computing environment;
• wherein the compliance evidence comprises information sufficient to allow a given one of the tenants to verify that the shared computing environment is configured in accordance with a specified security policy;
• and
• wherein the secure assessment environment is configured to maintain relationships between controls assessable by the tenants, sources of evidence relating to those controls, and corresponding service state information models.

An apparatus comprising:

• information technology infrastructure comprising:
• a computing environment shared by multiple tenants of a service provider;
• a secure assessment environment separate from the computing environment;
• an evidence collection module associated with the shared computing environment and configured to collect compliance evidence from the shared computing environment and to make the collected compliance evidence available to the secure assessment environment for storage therein;
• and
• a tenant assessment interface to the secure assessment environment configured to receive assessment requests from the multiple tenants and through which the multiple tenants can access the compliance evidence as stored in the secure assessment environment in a manner that does not undermine security of the shared computing environment;
• wherein the compliance evidence comprises information sufficient to allow a given one of the tenants to verify that the shared computing environment is configured in accordance with a specified security policy;
• and
• wherein the secure assessment environment is configured to provide different reconstitutions of at least a portion of the compliance evidence for different ones of the tenants so as to take into account respective different sets of benchmark content associated with those tenants.

A method comprising the steps of:

• collecting compliance evidence from a computing environment shared by multiple tenants of a service provider;
• storing the compliance evidence in a secure assessment environment separate from the computing environment;
• receiving assessment requests from two or more of the multiple tenants through a tenant assessment interface;
• and
• controllably permitting tenant access to the compliance evidence stored in the secure assessment environment through the tenant assessment interface in a manner that does not undermine security of the shared computing environment;
• wherein the collecting, storing and controllably permitting steps are implemented in a processing platform comprising at least one processing device having a processor coupled to a memory;
• and
• wherein the step of storing the compliance evidence comprises storing information sufficient to allow a given one of the tenants to verify that the shared computing environment is configured in accordance with a specified security policy;
• and
• wherein the step of collecting compliance evidence comprises collecting the compliance evidence based at least in part on expected tenant assessment requests.

A computer program product comprising a non-transitory processor-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by the processing platform cause the processing platform to perform the steps of:

• collecting compliance evidence from a computing environment shared by multiple tenants of a service provider;
• storing the compliance evidence in a secure assessment environment separate from the computing environment;
• receiving assessment requests from two or more of the multiple tenants through a tenant assessment interface;
• and
• controllably permitting tenant access to the compliance evidence stored in the secure assessment environment through the tenant assessment interface in a manner that does not undermine security of the shared computing environment;
• wherein the step of storing the compliance evidence comprises storing information sufficient to allow a given one of the tenants to verify that the shared computing environment is configured in accordance with a specified security policy;
• and
• wherein the step of collecting compliance evidence comprises collecting the compliance evidence based at least in part on expected tenant assessment requests.

An apparatus comprising:

• a processing platform comprising at least one processing device having a processor coupled to a memory;
• wherein said at least one processing device is configured to collect compliance evidence from a computing environment shared by multiple tenants of a service provider, to store the compliance evidence in a secure assessment environment separate from the computing environment, and to receive assessment requests from the multiple tenants through a tenant assessment interface;
• and
• wherein the tenants are controllably permitted access to the compliance evidence stored in the secure assessment environment through the tenant assessment interface in a manner that does not undermine security of the shared computing environment;
• and
• wherein the compliance evidence comprises information sufficient to allow a given one of the tenants to verify that the shared computing environment is configured in accordance with a specified security policy;
• and
• wherein said at least one processing device is configured to collect the compliance evidence based at least in part on expected tenant assessment requests.