Blackbox exposure (ops/control plane)

Why important?

The larger the operational black box, the more limited classic auditability becomes, and the more compensating controls and verification matter.

How measured?

• (higher = less black box / more transparency):
• 0 = Highly opaque (control plane/ops not traceable)
• 1 = Little transparency, few information/artefacts
• 2 = Partial transparency, important areas remain a black box
• 3 = Transparency for core areas, but relevant gaps (ops/control plane) remain
• 4 = High transparency (documentation, access concept, artefacts) with few gaps
• 5 = Very high transparency + verifiable artefacts (audit/evidence) also for ops/control plane
• N/A = no reliable evidence

Sources / Evidence

• https://www.aboutamazon.eu/news/aws/built-operated-controlled-and-secured-in-europe-aws-unveils-new-sovereign-controls-and-governance-structure-for-the-aws-european-sovereign-cloud
• https://docs.aws.amazon.com/whitepapers/latest/overview-aws-european-sovereign-cloud/design-approach.html
• https://aws.amazon.com/audit-manager/
• https://aws.amazon.com/config/
• https://www.plusserver.com/unternehmen/zertifikate-und-testate/
• https://www.plusserver.com/wp-content/uploads/2023/09/20250430_Bericht_BSI-C5_ISAE3402_Typ2_plusserver-GmbH-2024-3.pdf

Validation questions (RFP)

• Which parts cannot be verified technically (support tools, control plane)? Which technical controls compensate for this (customer keys, PAM, complete audit logs)?

Scores comparison