OPS-33 Confidential Computing - Remote Attestation

5 sub-criteria: 3 basic, 2 additional

New in C5:2026

Basic criterion

OPS-33.01B

If the cloud service comprises capabilities for confidential computing, the cloud service provider offers remote attestation functionalities for data in-use protection.

OPS-33.02B

Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.

OPS-33.03B

Remote attestation functionalities comprise an interface that allows the customer to verify the integrity of the remote attestation.

Supplementary information

The attestation interface allows customers to securely retrieve attestation evidence from the confidential computing environment. Verification of this evidence may be performed by the customer or by trusted third-party services.

Additional criterion

OPS-33.01AC

Additional, complementing

The cloud service provider clearly defines, documents and communicates the available attestation levels.

Supplementary information

Remote attestation can be performed at different locations and with different trust levels:

Cloud service customers retrieve evidence from TEEs and perform verification in an environment fully trusted by them. This scenario is generally assumed to provide a very strong attestation;
Cloud service providers retrieve evidence from TEEs, perform verification in verification services they control and provide verification results and evidence to the cloud service customer. Cloud service customers verify the attestation evidence in an environment fully trusted by them. This scenario is generally assumed to provide a very strong attestation;
Cloud service customers retrieve evidence from TEEs and send it to an evidence verification service they trust. This scenario is generally assumed to provide a strong attestation; and
Cloud service providers retrieve evidence from TEEs, send it to a verification service in their control and only return verification result to cloud service customers. This scenario is generally assumed to provide a weak attestation.

OPS-33.02AC