Market Rules and Compliance Glossary · Hosting & Cloud

Attestation of Compliance (PCI): the PCI DSS document a Qualified Security Assessor issues for a service provider's part in protecting cardholder data (Shared Responsibility & Compliance Programs).
attestation_scopes: the rows recording which services in which regions each compliance program covers over which period, so a trust portal, a sales answer and a responsibility matrix all agree and gaps are a query (Shared Responsibility & Compliance Programs).
Bridge letter: a provider's letter covering the gap between the end of an audit report's period and the next report, because customers' audit periods don't line up with the provider's (Shared Responsibility & Compliance Programs).
Bring your own license (BYOL): the customer supplying its own software licenses with mobility rights to run on a provider, subject to licensor restrictions such as Listed Provider terms (Licensing Disputes).
CISPE settlement: the July 2024 agreement in which the European cloud trade group withdrew its competition complaint over Microsoft's licensing in exchange for a product for European hosters, monitored by ECCO (Licensing Disputes).
CLOUD Act: the US law letting authorities compel a US provider to produce data in its possession, custody or control wherever it is stored, the concern sovereign cloud structures answer (Shared Responsibility & Compliance Programs).
CMA cloud market investigation: the UK Competition and Markets Authority's investigation, referred by Ofcom, whose 2025 final decision found an adverse effect on competition from egress fees, software licensing and committed spend (Competition Cases).
Complementary user entity controls: the controls a provider's audit report says its customers must operate for the provider's controls to achieve their objectives, the "in the cloud" half of shared responsibility written into the audit (Shared Responsibility & Compliance Programs).
Conduct regime designation: a regulator designating a firm for standing, tailored obligations, such as UK strategic market status or an EU DMA gatekeeper (Competition Cases).
DMA gatekeeper designation: the European Commission's Digital Markets Act investigations, opened in November 2025, into designating AWS and Azure as gatekeepers for cloud below the quantitative thresholds (Competition Cases).
ECCO (European Cloud Competition Observatory): the monitor that tracked Microsoft's delivery under the CISPE settlement with traffic-light ratings (Licensing Disputes).
Egress fee: the charge for data leaving a provider's network, the main switching cost that regulators targeted and that providers price as metered, bundled per server or zero (Egress & Switching).
EU Data Act switching rules: Chapter VI of Regulation (EU) 2023/2854, in force from September 2025, setting a two-month maximum notice to switch, transitional and retrieval periods, the phase-out of switching charges and interoperability duties (Egress & Switching).
Exit waiver: free data transfer out for a customer leaving a provider, granted on request and usually as credits after approval, offered by the three hyperscalers from 2024 (Egress & Switching).
FedRAMP: the US authorization program for federal agencies' use of cloud services, run under Rev5 with agency sponsors or the newer 20x process (Shared Responsibility & Compliance Programs).
FedRAMP 20x: FedRAMP's newer authorization process, piloted in phases and offered in classes by impact level, which a provider starting today should plan on instead of Rev5 (Shared Responsibility & Compliance Programs).
GovRAMP: the non-profit verification program for state and local governments, formerly StateRAMP, the state and local counterpart to FedRAMP (Shared Responsibility & Compliance Programs).
ISO/IEC 27001: the certification of an information security management system against the standard, with 27017 and 27018 adding cloud and personal-data controls (Shared Responsibility & Compliance Programs).
License Mobility: Microsoft's Software Assurance right to bring licenses to any provider, as distinct from licenses without mobility rights, which can't be deployed on Listed Providers (Licensing Disputes).
License-included SKU: a provider-supplied software license sold as a pass-through SKU with its own price versions, so a licensor's price change is a new version with notice (Licensing Disputes).
Listed Providers: the clouds (Microsoft, Alibaba, Amazon and Google) on which Microsoft's outsourcing terms restrict deploying licenses that lack mobility rights; any other provider is an Authorized Outsourcer (Licensing Disputes).
Multicloud transfer at cost: discounted or zero-charge transfer for traffic a customer designates between a provider and another cloud while using both, offered by Google and Azure in 2025 to meet the Data Act (Egress & Switching).
PCI DSS Appendix A1: the additional PCI DSS requirements for multi-tenant service providers, part of what a host's responsibility matrix covers (Shared Responsibility & Compliance Programs).
Responsibility matrix: for each requirement of a framework such as PCI DSS, whether the provider, the customer or both are responsible, per service; the deliverable customers actually use (Shared Responsibility & Compliance Programs).
Scope (attestation): what a compliance program certifies: named services in named regions over a named period, not a company; a service outside scope inherits nothing (Shared Responsibility & Compliance Programs).
Shared responsibility model: the split in which the provider secures the cloud itself (hardware, software, networking, facilities) and the customer secures what it puts in the cloud; a contract boundary more than a security design (Shared Responsibility & Compliance Programs).
SOC 2: an audit report on controls against the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy), over a period (Type 2) or at a point in time (Type 1) (Shared Responsibility & Compliance Programs).
Sovereign cloud: not an audit but a structure of legal entities, staff, locations and keys arranged so the provider's home government can't reach the data; a spectrum from data location to operational, key and legal control (Shared Responsibility & Compliance Programs).
Strategic market status (SMS): the UK digital markets regime's designation that lets the CMA impose conduct requirements on a firm, the route it chose for Microsoft's cloud licensing (Competition Cases).
Subservice organization: a provider a service relies on (a PaaS's hyperscaler) named in the audit report, whose controls are carved out or included (Shared Responsibility & Compliance Programs).
Switching charges: charges for moving to another provider, which the EU Data Act allows only as reduced charges not exceeding the provider's costs until January 2027 (Egress & Switching).
Trust Services Criteria: the AICPA criteria a SOC 2 report tests controls against, currently the 2017 criteria with revised points of focus (Shared Responsibility & Compliance Programs).
VCSP (VMware Cloud Service Provider program): VMware's program for providers reselling VMware-based private cloud, which Broadcom phased out with its white-label model in the EEA from late 2025, replacing it with an invitation-only program (Licensing Disputes).
VMware perpetual license end: Broadcom's December 2023 move ending perpetual VMware licenses and their support renewals in favor of subscriptions, which customers challenged in court (Licensing Disputes).
Voluntary commitments (competition): steps firms design and offer instead of binding remedies, fast but not binding and dependent on review, as the CMA accepted in March 2026 (Competition Cases).

Attestation of Compliance (PCI): the PCI DSS document a Qualified Security Assessor issues for a service provider's part in protecting cardholder data (Shared Responsibility & Compliance Programs).
attestation_scopes: the rows recording which services in which regions each compliance program covers over which period, so a trust portal, a sales answer and a responsibility matrix all agree and gaps are a query (Shared Responsibility & Compliance Programs).
Bridge letter: a provider's letter covering the gap between the end of an audit report's period and the next report, because customers' audit periods don't line up with the provider's (Shared Responsibility & Compliance Programs).
Bring your own license (BYOL): the customer supplying its own software licenses with mobility rights to run on a provider, subject to licensor restrictions such as Listed Provider terms (Licensing Disputes).
CISPE settlement: the July 2024 agreement in which the European cloud trade group withdrew its competition complaint over Microsoft's licensing in exchange for a product for European hosters, monitored by ECCO (Licensing Disputes).
CLOUD Act: the US law letting authorities compel a US provider to produce data in its possession, custody or control wherever it is stored, the concern sovereign cloud structures answer (Shared Responsibility & Compliance Programs).
CMA cloud market investigation: the UK Competition and Markets Authority's investigation, referred by Ofcom, whose 2025 final decision found an adverse effect on competition from egress fees, software licensing and committed spend (Competition Cases).
Complementary user entity controls: the controls a provider's audit report says its customers must operate for the provider's controls to achieve their objectives, the "in the cloud" half of shared responsibility written into the audit (Shared Responsibility & Compliance Programs).
Conduct regime designation: a regulator designating a firm for standing, tailored obligations, such as UK strategic market status or an EU DMA gatekeeper (Competition Cases).
DMA gatekeeper designation: the European Commission's Digital Markets Act investigations, opened in November 2025, into designating AWS and Azure as gatekeepers for cloud below the quantitative thresholds (Competition Cases).
ECCO (European Cloud Competition Observatory): the monitor that tracked Microsoft's delivery under the CISPE settlement with traffic-light ratings (Licensing Disputes).
Egress fee: the charge for data leaving a provider's network, the main switching cost that regulators targeted and that providers price as metered, bundled per server or zero (Egress & Switching).
EU Data Act switching rules: Chapter VI of Regulation (EU) 2023/2854, in force from September 2025, setting a two-month maximum notice to switch, transitional and retrieval periods, the phase-out of switching charges and interoperability duties (Egress & Switching).
Exit waiver: free data transfer out for a customer leaving a provider, granted on request and usually as credits after approval, offered by the three hyperscalers from 2024 (Egress & Switching).
FedRAMP: the US authorization program for federal agencies' use of cloud services, run under Rev5 with agency sponsors or the newer 20x process (Shared Responsibility & Compliance Programs).
FedRAMP 20x: FedRAMP's newer authorization process, piloted in phases and offered in classes by impact level, which a provider starting today should plan on instead of Rev5 (Shared Responsibility & Compliance Programs).
GovRAMP: the non-profit verification program for state and local governments, formerly StateRAMP, the state and local counterpart to FedRAMP (Shared Responsibility & Compliance Programs).
ISO/IEC 27001: the certification of an information security management system against the standard, with 27017 and 27018 adding cloud and personal-data controls (Shared Responsibility & Compliance Programs).
License Mobility: Microsoft's Software Assurance right to bring licenses to any provider, as distinct from licenses without mobility rights, which can't be deployed on Listed Providers (Licensing Disputes).
License-included SKU: a provider-supplied software license sold as a pass-through SKU with its own price versions, so a licensor's price change is a new version with notice (Licensing Disputes).
Listed Providers: the clouds (Microsoft, Alibaba, Amazon and Google) on which Microsoft's outsourcing terms restrict deploying licenses that lack mobility rights; any other provider is an Authorized Outsourcer (Licensing Disputes).
Multicloud transfer at cost: discounted or zero-charge transfer for traffic a customer designates between a provider and another cloud while using both, offered by Google and Azure in 2025 to meet the Data Act (Egress & Switching).
PCI DSS Appendix A1: the additional PCI DSS requirements for multi-tenant service providers, part of what a host's responsibility matrix covers (Shared Responsibility & Compliance Programs).
Responsibility matrix: for each requirement of a framework such as PCI DSS, whether the provider, the customer or both are responsible, per service; the deliverable customers actually use (Shared Responsibility & Compliance Programs).
Scope (attestation): what a compliance program certifies: named services in named regions over a named period, not a company; a service outside scope inherits nothing (Shared Responsibility & Compliance Programs).
Shared responsibility model: the split in which the provider secures the cloud itself (hardware, software, networking, facilities) and the customer secures what it puts in the cloud; a contract boundary more than a security design (Shared Responsibility & Compliance Programs).
SOC 2: an audit report on controls against the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy), over a period (Type 2) or at a point in time (Type 1) (Shared Responsibility & Compliance Programs).
Sovereign cloud: not an audit but a structure of legal entities, staff, locations and keys arranged so the provider's home government can't reach the data; a spectrum from data location to operational, key and legal control (Shared Responsibility & Compliance Programs).
Strategic market status (SMS): the UK digital markets regime's designation that lets the CMA impose conduct requirements on a firm, the route it chose for Microsoft's cloud licensing (Competition Cases).
Subservice organization: a provider a service relies on (a PaaS's hyperscaler) named in the audit report, whose controls are carved out or included (Shared Responsibility & Compliance Programs).
Switching charges: charges for moving to another provider, which the EU Data Act allows only as reduced charges not exceeding the provider's costs until January 2027 (Egress & Switching).
Trust Services Criteria: the AICPA criteria a SOC 2 report tests controls against, currently the 2017 criteria with revised points of focus (Shared Responsibility & Compliance Programs).
VCSP (VMware Cloud Service Provider program): VMware's program for providers reselling VMware-based private cloud, which Broadcom phased out with its white-label model in the EEA from late 2025, replacing it with an invitation-only program (Licensing Disputes).
VMware perpetual license end: Broadcom's December 2023 move ending perpetual VMware licenses and their support renewals in favor of subscriptions, which customers challenged in court (Licensing Disputes).
Voluntary commitments (competition): steps firms design and offer instead of binding remedies, fast but not binding and dependent on review, as the CMA accepted in March 2026 (Competition Cases).