ISO/IEC PRF TS 25052-1

Systems and software engineering — Systems and software Quality Requirements and Evaluation (SQuaRE): cloud services — Part 1: Quality model

Ingénierie des systèmes et du logiciel — Exigences de qualité et évaluation des systèmes et du logiciel (SQuaRE): services en nuage — Partie 1: Modèles de qualité

General Information

• Status: Not Published
• ICS: 35.080 - Software
• Technical Committee: ISO/IEC JTC 1/SC 7 - Software and systems engineering
• Drafting Committee: ISO/IEC JTC 1/SC 7 - Software and systems engineering
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Start Date: 17-May-2022
• Completion Date: 17-May-2022

Standards Content (sample)

© ISO/IEC 2021– All rights reserved
ISO/IEC TS 25052--1:2022(E)
ISO/IEC JTC 1/SC 7/WG 6
Date: 2022-05-16
Secretariat: ANSI
Systems and software engineering — Systems and software Quality Requirements and
Evaluation (SQuaRE): cloud services – Part 1: Quality Model model
Publication stage
Warning for WDs and CDs

This document is not an ISO International Standard. It is distributed for review and comment. It is subject to

change without notice and may not be referred to as an International Standard.

Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of

which they are aware and to provide supporting documentation.

To help you, this guide on writing standards was produced by the ISO/TMB and is available at

https://www.iso.org/iso/how-to-write-standards.pdf

A model manuscript of a draft International Standard (known as “The Rice Model”) is available at

https://www.iso.org/iso/model_document-rice_model.pdf
---------------------- Page: 1 ----------------------
© ISO 2020

Ingénierie des systèmes et du logiciel — Exigences de qualité et évaluation des systèmes et du logiciel

(SQuaRE): services en nuage — Partie 1: Modèles de qualité
---------------------- Page: 2 ----------------------
ISO/IEC TS 25052-1:2022(E)
© ISO 2022

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no

part of this publication may be reproduced or utilized otherwise in any form or by any means,

electronic or mechanical, including photocopying, or posting on the internet or an intranet, without

prior written permission. Permission can be requested from either ISO at the address below or

ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Website: www.iso.orgwww.iso.org
Published in Switzerland
iv © ISO/IEC 2022 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/IEC TS 25052-1:2022(E)
Contents

Foreword .......................................................................................................................................................................... 3

Introduction..................................................................................................................................................................... 4

1 Scope .................................................................................................................................................................... 7

2 Normative references .................................................................................................................................... 7

3 Terms and definitions .................................................................................................................................... 8

3.1 Quality Model of Cloud Services ................................................................................................................. 8

3.1.1 service performance efficiency .................................................................................................................. 8

3.1.2 service compatibility ...................................................................................................................................... 9

3.1.3 service usability ............................................................................................................................................... 9

3.1.4 service reliability.......................................................................................................................................... 10

3.1.5 service security ............................................................................................................................................. 11

3.1.6 service maintainability .............................................................................................................................. 12

3.1.7 portability ....................................................................................................................................................... 13

3.1.8 service provisionability ............................................................................................................................. 13

3.1.9 service responsiveness .............................................................................................................................. 14

3.2 Terms relating to software quality ........................................................................................................ 16

3.2.1 software quality ............................................................................................................................................ 16

3.2.2 quality model ................................................................................................................................................. 16

3.2.3 software quality characteristic ............................................................................................................... 16

3.2.4 measure (noun) ............................................................................................................................................ 16

3.2.5 measurement ................................................................................................................................................. 16

3.3 Terms relating to cloud computing ....................................................................................................... 17

3.3.1 cloud computing ........................................................................................................................................... 17

3.3.2 cloud service .................................................................................................................................................. 17

3.3.3 cloud service customer .............................................................................................................................. 17

3.3.4 cloud service provider ................................................................................................................................ 17

3.3.5 cloud service user......................................................................................................................................... 17

3.3.6 cloud service partner .................................................................................................................................. 18

3.3.7 Service Level Agreement SLA ................................................................................................................... 18

3.3.8 cloud service qualitative objective cloud SQO ................................................................................. 18

3.3.9 cloud service level agreement cloud SLA ............................................................................................ 18

3.3.10 cloud service level objective cloud SLO ............................................................................................... 19

3.3.11 cloud service agreement ............................................................................................................................ 19

3.3.12 information security ................................................................................................................................... 19

3.3.13 personally identifiable information (PII) ............................................................................................ 19

4 Abbreviations ................................................................................................................................................ 20

5 Quality Model Framework ........................................................................................................................ 21

5.1 Overview .......................................................................................................................................................... 21

5.2 Relationships between Quality Model of Cloud Services and Other Quality Models ........... 22

5.3 Quality Model of Cloud Services .............................................................................................................. 23

Annex A (Informative) Original Source of Characteristics of Quality Model ...................................... 24

Bibliography ................................................................................................................................................................. 26

© ISO/IEC 2022 – All rights reserved v
---------------------- Page: 4 ----------------------
ISO/IEC TS 25052-1:2022(E)
vi © ISO/IEC 2022 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/IEC TS 25052-1:2022(E)
Foreword

ISO (the International Organization for Standardization) is a and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide federation of national

standardsstandardization. National bodies (that are members of ISO member bodies). The workor IEC

participate in the development of preparing International Standards is normally carried out through ISO

technical committees. Each member body interested in a subject for which a technical committee has

been established has the right to be represented on that committee. Internationalby the respective

organization to deal with particular fields of technical activity. ISO and IEC technical committees

collaborate in fields of mutual interest. Other international organizations, governmental and non-

governmental, in liaison with ISO and IEC, also take part in the work. ISO collaborates closely with the

International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documentsdocument should be noted. This document was drafted in accordance

with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives 2 (see

www.iso.org/directives or www.iec.ch/members_experts/refdocs).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details

of any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www.iso.org/patentswww.iso.org/patents) or the IEC

list of patent declarations received (see https://patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the World

Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see

www.iso.org/iso/foreword.html) see www.iso.org/iso/foreword.html. In the IEC, see

www.iec.ch/understanding-standards.

This document was prepared by Joint Technical Committee ISO/IEC JTC1 SC7/WG6JTC 1, Information

technology, Subcommittee SC 7, Software and systems engineering.

A list of all parts in the ISO/IEC TS 25052 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A

complete listing of these bodies can be found at www.iso.org/members.htmlwww.iso.org/members.html

and www.iec.ch/national-committees.
© ISO/IEC 2022 – All rights reserved vii
---------------------- Page: 6 ----------------------
ISO/IEC TS 25052-1:2022(E)
Introduction

In the SQuaRE series, there are well-defined quality models for measuring and evaluating system and

software products, IT services, data, and so onetc. Although the SQuaRE series provides practical quality

models, it does not fit new technologies well. To support the evaluation of new technologies, this

document provides the quality model of cloud services, which is the extension to the quality models

defined in ISO/IEC 2501n. As the extension of SQuaRE series, this document provides a quality model of

cloud services. 2501n. In order to provide a practical guideline for quality evaluation of cloud services,

this document has reflected special considerations on cloud computing, which are key characteristics,

and cross-cutting aspects described in ISO/IEC 17788, and Service Level Agreementservice level

agreement (SLA) framework described in ISO/IEC 19086, and so on. (all parts).

Compared to the information and communication technology (ICT) systems, cloud computing has

different characteristics. The followings are the key characteristics of cloud computing described in

ISO/IEC 17788.

— Broad network access: physical or virtual resources are available when needed through the network

using a variety of client devices.
— Measured service: resources are measured and paid for on a usage basis .

— Multi-tenancy: physical and virtual resources are allocated to multiple tenants, and their

computations and data are isolated, therefore inaccessible from one another .

— On-demand self-service: cloud services are provisioned by cloud service customers automatically or

with minimal interaction with cloud service providers .

— Rapid elasticity and scalability: resources are increased or decreased rapidly and elastically, and

scalable horizontally and vertically .

— Resource pooling: physical or virtual resources are aggregated to provide services to one or more

cloud service customers.

The quality model in this document is to support the non-functional specification and evaluation of cloud

services from different perspectives by those associated with cloud service selection, requirements

analysis, development, use, evaluation, support, maintenance, quality assurance and control, and audit.

For example, activities during cloud service selection that can benefit from the use of the quality model

include:
— identifying cloud services requirements;
— establishing cloud service selection criteria;
— defining service coverage and service objectives;
— establishing service level agreements;

— establishing measures of quality characteristics in support of these activities.

Activities during cloud service development that can benefit from the use of the quality model include:

— identifying cloud service requirements;
— validating comprehensiveness of requirement definitions;
viii © ISO/IEC 2022 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC TS 25052-1:2022(E)
— identifying cloud service design objectives;
— identifying cloud service testing objectives;
— identifying quality control criteria as part of quality assurance;
— identifying acceptance criteria for a cloud service;

— establishing measures of quality characteristics in support of these activities.

Figure 1 (adapted from ISO/IEC 25000) illustrates the organization of the SQuaRE series representing

families of standards, further called divisions. This document belongs to Extension Divisionextension

division 25050 -to 25099.
© ISO/IEC 2022 – All rights reserved ix
---------------------- Page: 8 ----------------------
ISO/IEC TS 25052-1:2022(E)
Figure 1 — Organization of the SQuaRE series of International Standards
The divisions within the SQuaRE series are:

— ISO/IEC 2500n - Quality Management Divisionmanagement division. The International

Standards that form this division define all common models, terms and definitions further referred

to by all other International Standards from the SQuaRE series. The division also provides

requirements and guidance for a supporting function that is responsible for the management of the

requirements, specification and evaluation of software product quality.

— ISO/IEC 2501n - Quality Model Divisionmodel division. The International Standards that form

this division present detailed quality models for computer systems and software products, quality in

use, and data. Practical guidance on the use of the quality models is also provided.

— ISO/IEC 2502n - Quality Measurement Divisionmeasurement division. The International

Standards that form this division include a quality model framework, mathematical definitions of

quality measures, and practical guidance for their application. Examples are given of quality

measures for software quality, and measures for quality in use. Quality Measure Elementsmeasure

elements (QME) forming foundations for these measures are defined and presented.

— ISO/IEC 2503n - Quality Requirements Divisionrequirements division. The International

Standards that form this division help specify quality requirements, based on quality models and

quality measures. These quality requirements can be used in the process of quality requirements

elicitation for a software product to be developed or as input for an evaluation process.

— ISO/IEC 2504n - Quality Evaluation Divisionevaluation division. The International Standards

that form this division provide requirements, recommendations and guidelines for software product

evaluation, whether performed by evaluators, acquirers or developers. The support for documenting

a measure as an Evaluation Moduleevaluation module is also presented.
x © ISO/IEC 2022 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC TS 25052-1:2022(E)

— ISO/IEC 25050 –to ISO/IEC 25099 - SQuaRE Extension Division. Theseextension division. This

division includes International Standards currently includespecifying requirements for quality of

Readyready to Use Software Productuse software product and Common Industry Formatscommon

industry formats for usability reports, as well as this Technical Specificationdocument.

© ISO/IEC 2022 – All rights reserved xi
---------------------- Page: 10 ----------------------
TECHNICAL SPECIFICATION ISO/IEC TS 25052-1:2022(E)
© ISO/IEC 2022 – All rights reserved 1
---------------------- Page: 11 ----------------------
ISO/IEC TS 25052-1:2022(E)
Software engineering — Systems and software Quality
Requirements and Evaluation (SQuaRE): cloud services – Part 1:
Quality Model
model
1 Scope

This Technical Specification consists of three parts: quality model, measurement, and evaluation guide.

As the first part of Technical Specification, this document defines the quality modelsmodel of cloud

services.

The quality model of cloud services is composed of 9nine characteristics (some of which are further

subdivided into subcharacteristics), which providesprovide consistent terminology for specifying,

measuring and evaluating cloud services so that the stakeholders, cloud service customer (CSC (Cloud

Service Customer), ), cloud service provider (CSP (Cloud Service Provider) and cloud service partner

(CSN (Cloud Service Partner),) have a common understanding.

Since the quality model in this document is the extension to the existing quality models defined in

ISO/IEC 2501n, it can be used with the product quality model, IT service quality model, data quality

model, and quality-in-use model according to evaluation scope. Therepurposes. As there are several cloud

service categories, so this document takes a step by step approach. For this reason, this document focuses

on the quality model of SaaS (Software as a Service), and then will be extended into PaaS (Platform as a

Service) and IaaS (Infrastructure as a Service).

NOTE Future documents are intended to address PaaS (Platform as a Service) and IaaS (Infrastructure as a

Service).
2 Normative references

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

ISO/IEC 25000:2014 -, Systems and software engineering — Systems and software Quality Requirements

and Evaluation (SQuaRE) — Guide to SQuaRE

ISO/IEC 22123-1:2021, Information technology — Cloud computing — Part 1: Vocabulary

2 © ISO 2021 – All rights reserved
2 © ISO/IEC 2022 – All rights reserved
---------------------- Page: 12 ----------------------
ISO/IEC TS 25052-1:2022(E)
43 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/IEC 25000, ISO/IEC 22123-1,

and the following apply.

ISO and IEC maintain terminologicalterminology databases for use in standardization at the following

addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp
Field Code Changed

— IEC Electropedia: available at http://www.electropedia.org/https://www.electropedia.org/

4.23.1 Quality Modelmodel of Cloud Servicescloud services
3.1.1
service performance efficiency

degree to which a cloud service meets performance requirements under stated conditions

3.1.1.1
time -behaviour

degree to which a cloud service meets the requirements of the response times and throughput rates of a

cloud service, when concurrent users take advantage of the cloud service

[SOURCE: ISO/IEC 25010:2011, 4.2.2.1, modified- " — “a cloud service meets the requirements of” has

been added, "“a product or system"” has been replaced by “a cloud service” and "“when performing its

functions, meet requirements"” by "“when concurrent users take advantage of the cloud service".]”]

3.1.1.2
aggregated resource utilization

degree to which a cloud service utilizes efficiently aggregated resources from resource pooling in order

to support multi-tenancy

Note 1 to entry: Resource pooling is the feature where physical or virtual resources can be aggregated to provide a

cloud service to one or more cloud service customers.
Note 2 to entry: Resources include CPU, memory, disk and network.
© ISO/IEC 2021 – All rights reserved 3
© ISO/IEC 2022 – All rights reserved 3
---------------------- Page: 13 ----------------------
ISO/IEC TS 25052-1:2022(E)
3.1.1.3
capacity

degree to which the maximum limits of a cloud service’s parameters meet requirements in SLA (Service

Level Agreement)

Note1Note 1 to entry: Parameters can include the limit of simultaneous cloud service connections, the limit of

available cloud service resources, cloud service throughput and cloud service bandwidth.

[SOURCE: ISO/IEC 25010:2011, 4.2.2.3, modified- " — “a product or system parameter"” has been

replaced by "“a cloud service's parameters"” and "“in SLA (Service Level Agreement)")” has been added.

3.1.1.4
scalability

degree to which physical and virtual resources are available automatically and immediately, when they

are needed, subject to constraints of service agreements
3.1.1.5
elasticity

degree to which a cloud service adjusts rapidly and elastically the amount of resources that are allocated

to an instance of the service
3.1.2
service compatibility

degree to which a cloud service can exchange information with CSC’s systems or other cloud services

and/or perform its required functions

[SOURCE: ISO/IEC 25010:2011, 4.2.3, modified- "“a product, system or component"” has been replaced

by “a cloud service” and "“other products, systems or components"” by "“CSC’s systems or other cloud

services",”, and "“while sharing the same hardware or software environment"” has been deleted.]

3.1.2.1
cloud interoperability

degree to which a cloud service interacts with CSC's systems, or interacts with other cloud services, by

exchanging information according to a prescribed method to obtain predictable results

[SOURCE: ISO/IEC 22123-1: 2021, 3.7.2, modified-" — “ability of a CSC’s system to interact with a cloud

service, or the ability for one cloud service to interact"” has been replaced by "“degree to which a cloud

service interacts with CSC's systems, or interacts"]”]
4 © ISO 2021 – All rights reserved
4 © ISO/IEC 2022 – All rights reserved
---------------------- Page: 14 ----------------------
ISO/IEC TS 25052-1:2022(E)
3.1.3
service usability

degree to which a cloud service can be used by specified users to achieve specified goals with

effectiveness, efficiency and satisfaction in a specified context of use

[SOURCE: ISO/IEC 25010:2011, 4.2.4, modified- " — “a product or system"” has been replaced by "“a

cloud service"]”]
3.1.3.1
accessibility

degree to which a cloud service can be accessed by a variety of client devices over a network through

standard mechanisms
3.1.4
service reliability

degree to which a cloud service performs specified functions under specified conditions for a specified

period of time

[SOURCE: ISO/IEC 25010:2011, 4.2.5, modified- " — “a system, product or component"” has been

replaced by "“a cloud service"]”]
3.1.4.1
availability

degree to which a cloud service is accessible and usable upon demand by an authorized entity

[SOURCE: ISO/IEC 22123-1: 2021, 3.14.7, modified - "— “property of being"” has been replaced by

"“degree to which a cloud service is"]”]
3.1.4.2
resilience

degree to which a cloud service recovers operational condition quickly after a fault occurs

[SOURCE: ISO/IEC 1980619086-1:2016, 3.19, modified - "— “ability of"” has been replaced by "“degree

to which"]”]
3.1.4.3
recoverability
© ISO/IEC 2021 – All rights reserved 5
© ISO/IEC 2022 – All rights reserved 5
---------------------- Page: 15 ----------------------
ISO/IEC TS 25052-1:2022(E)

degree to which a cloud service supports its critical business functions to an acceptable level within a

predetermined period of time following a disaster

[SOURCE: ISO/IEC 19086-1:2016, 3.7, modified - "— “ability of the ICT elements of an organization to

support"” has been replaced by "“degree to which a cloud service supports"]”]
3.1.5
service security

degree to which a cloud service protects information and data so that persons or other products or

systems have the degree of data access appropriate to their types and levels of authorization

[SOURCE: ISO/IEC 25010:2011, 4.2.6, modified - "— “a product or system"” has been replaced by "“a

cloud service"]”]
3.1.5.1
confidentiality

degree to which a cloud service ensures that data are accessible only to those authorized to have access

[SOURCE: ISO/IEC 25010:2011, 4.2.6.1, modified - "— “a product or system” has been replaced by “a

cloud service"]”]
3.1.5.2
accountability

degree to which the actions of an entity can be traced back uniquely to the entity

[SOURCE: ISO/IEC 25010:2011, 4.2.6.4 –— “back” has been added]
3.1.5.3
isolation

degree to which computations and data of a cloud service are isolated from and inaccessible to one

another in the situation that physical and virtual resources are shared by multi-tenants

3.1.5.4
PII (Personally Identifiable Information)protection conformance
personally identifiable information protection conformance

degree to which a cloud service conforms to the standards, laws, or regulations applied to collection,

processing and disposal of PII (Personally Identifiable Informationpersonally identifiable information)

6 © ISO 2021 – All rights reserved
6 © ISO/IEC 2022 – All rights reserved
---------------------- Page: 16 ----------------------
ISO/IEC TS 25052-1:2022(E)

Note 1 to entry: The scope of PII is determined by laws or regulations of the country where a cloud service is

provided. If privacy data, such as race, religion, and health, is considered PII, a cloud service needs to conform

toaddress compliance with relating laws or regulations to protect the privacy data.

3.1.5.5
security responsibility

degree to which the security responsibilities of both CSC and CSP are clearly defined and security

incidents are detected and reported by either party
3.1.5.6
asset protection

degree to which a cloud service has processes to protect physical facilities used to provide the covered

services from loss of data, connectivity and availability of necessary infrastructure and IT equipment, and

to secure the covered services during operation

Note 1 to entry: Connections to cloud services should be protected, and therefore far less vulnerable to virus or

other malware attacks. They should also be strong enough to withstand determined Distributed Denialdistributed

denial of Serviceservice (DDoS) attacks from hackers and botnets.
3.1.6
service maintainability

degree of effectiveness and efficiency with which a cloud service can be modified by the intended

maintainers

Note 1 to entry: Modifications can include corrections, improvements or adaptation of a cloud service to changes

in environment, and in requirements and functional specifications. Modifications include those carried out by

specialized support staff, and those carried out by business or operational staff, or end users.

Note 2 to entry: Maintainability includes installation of updates and upgrades.

[SOURCE: ISO/IEC 25010:2011, 4.2.7, modified - "— “a product or system"” has been replaced by "“a

cloud service"]”]
3.1.6.1
maintenance compliance and versioning

degree to which a cloud service provides maintenance according to the SLA, and a new version is assigned

and published after maintenance
© ISO/IEC 2021 – All rights reserved 7
...

TECHNICAL ISO/IEC TS
SPECIFICATION 25052-1
First edition
Systems and software engineering —
Systems and software Quality
Requirements and Evaluation
(SQuaRE): cloud services —
Part 1:
Quality model
Ingénierie des systèmes et du logiciel — Exigences de qualité et
évaluation des systèmes et du logiciel (SQuaRE): services en nuage —
Partie 1: Modèles de qualité
PROOF/ÉPREUVE
Reference number
ISO/IEC TS 25052-1:2022(E)
© ISO/IEC 2022
---------------------- Page: 1 ----------------------
ISO/IEC TS 25052-1:2022(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2022

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on

the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below

or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
PROOF/ÉPREUVE © ISO/IEC 2022 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC TS 25052-1:2022(E)
Contents Page

Foreword ........................................................................................................................................................................................................................................iv

Introduction .................................................................................................................................................................................................................................v

1 S c op e ................................................................................................................................................................................................................................. 1

2 Nor m at i ve r ef er enc e s ..................................................................................................................................................................................... 1

3 Terms and definitions .................................................................................................................................................................................... 1

3.1 Q uality model of cloud services ........................................................................................................................................... .... 1

3.2 T erms relating to software quality ...................................................................................................................................... 6

3.3 T erms relating to cloud computing ...................................................................................................................................... 7

4 Abbr ev i at ed t er m s ............................................................................................................................................................................................. 9

5 Quality model framework ..........................................................................................................................................................................9

5 .1 O ver v iew ...................................................................................................................................................................................................... 9

5.2 R elationships between quality model of cloud services and other quality models ............... 10

5.3 Q uality model of cloud services ........................................................................................................................................... . 11

Annex A (informative) Original source of characteristics of quality model ..........................................................13

Bibliography .............................................................................................................................................................................................................................15

iii
© ISO/IEC 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 3 ----------------------
ISO/IEC TS 25052-1:2022(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical

activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work.

The procedures used to develop this document and those intended for its further maintenance

are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria

needed for the different types of document should be noted. This document was drafted in

accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or

www.iec.ch/members_experts/refdocs).

Attention is drawn to the possibility that some of the elements of this document may be the subject

of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent

rights. Details of any patent rights identified during the development of the document will be in the

Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC

list of patent declarations received (see https://patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to

the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see

www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,

Subcommittee SC 7, Software and systems engineering.

A list of all parts in the ISO/IEC TS 25052 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards

body. A complete listing of these bodies can be found at www.iso.org/members.html and

www.iec.ch/national-committees.
PROOF/ÉPREUVE © ISO/IEC 2022 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC TS 25052-1:2022(E)
Introduction

In the SQuaRE series, there are well-defined quality models for measuring and evaluating system and

software products, IT services, data, etc. Although the SQuaRE series provides practical quality models,

it does not fit new technologies well. To support the evaluation of new technologies, this document

provides the quality model of cloud services, which is the extension to the quality models defined in

ISO/IEC 2501n. In order to provide a practical guideline for quality evaluation of cloud services, this

document has reflected special considerations on cloud computing, which are key characteristics,

and cross-cutting aspects described in ISO/IEC 17788, and service level agreement (SLA) framework

described in ISO/IEC 19086 (all parts).

Compared to the information and communication technology (ICT) systems, cloud computing has

different characteristics. The followings are the key characteristics of cloud computing described in

ISO/IEC 17788.

— Broad network access: physical or virtual resources are available when needed through the network

using a variety of client devices.
— Measured service: resources are measured and paid for on a usage basis.

— Multi-tenancy: physical and virtual resources are allocated to multiple tenants, and their

computations and data are isolated, therefore inaccessible from one another.

— On-demand self-service: cloud services are provisioned by cloud service customers automatically or

with minimal interaction with cloud service providers.

— Rapid elasticity and scalability: resources are increased or decreased rapidly and elastically, and

scalable horizontally and vertically.

— Resource pooling: physical or virtual resources are aggregated to provide services to one or more

cloud service customers.

The quality model in this document is to support the non-functional specification and evaluation of cloud

services from different perspectives by those associated with cloud service selection, requirements

analysis, development, use, evaluation, support, maintenance, quality assurance and control, and audit.

For example, activities during cloud service selection that can benefit from the use of the quality model

include:
— identifying cloud services requirements;
— establishing cloud service selection criteria;
— defining service coverage and service objectives;
— establishing service level agreements;

— establishing measures of quality characteristics in support of these activities.

Activities during cloud service development that can benefit from the use of the quality model include:

— identifying cloud service requirements;
— validating comprehensiveness of requirement definitions;
— identifying cloud service design objectives;
— identifying cloud service testing objectives;
— identifying quality control criteria as part of quality assurance;
— identifying acceptance criteria for a cloud service;
© ISO/IEC 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 5 ----------------------
ISO/IEC TS 25052-1:2022(E)

— establishing measures of quality characteristics in support of these activities.

Figure 1 (adapted from ISO/IEC 25000) illustrates the organization of the SQuaRE series representing

families of standards, further called divisions. This document belongs to extension division 25050 to

25099.
Figure 1 — Organization of the SQuaRE series of International Standards
The divisions within the SQuaRE series are:

— ISO/IEC 2500n - Quality management division. The International Standards that form this division

define all common models, terms and definitions further referred to by all other International

Standards from the SQuaRE series. The division also provides requirements and guidance for a

supporting function that is responsible for the management of the requirements, specification and

evaluation of software product quality.

— ISO/IEC 2501n - Quality model division. The International Standards that form this division

present detailed quality models for computer systems and software products, quality in use, and

data. Practical guidance on the use of the quality models is also provided.

— ISO/IEC 2502n - Quality measurement division. The International Standards that form this

division include a quality model framework, mathematical definitions of quality measures, and

practical guidance for their application. Examples are given of quality measures for software

quality, and measures for quality in use. Quality measure elements (QME) forming foundations for

these measures are defined and presented.

— ISO/IEC 2503n - Quality requirements division. The International Standards that form this

division help specify quality requirements, based on quality models and quality measures. These

quality requirements can be used in the process of quality requirements elicitation for a software

product to be developed or as input for an evaluation process.

— ISO/IEC 2504n - Quality evaluation division. The International Standards that form this division

provide requirements, recommendations and guidelines for software product evaluation, whether

performed by evaluators, acquirers or developers. The support for documenting a measure as an

evaluation module is also presented.
PROOF/ÉPREUVE © ISO/IEC 2022 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC TS 25052-1:2022(E)

— ISO/IEC 25050 to ISO/IEC 25099 - SQuaRE extension division. This division includes International

Standards specifying requirements for quality of ready to use software product and common

industry formats for usability reports, as well as this document.
vii
© ISO/IEC 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 7 ----------------------
TECHNICAL SPECIFICATION ISO/IEC TS 25052-1:2022(E)
Systems and software engineering — Systems and software
Quality Requirements and Evaluation (SQuaRE): cloud
services —
Part 1:
Quality model
1 S cope
This document defines the quality model of cloud services.

The quality model of cloud services is composed of nine characteristics (some of which are further

subdivided into subcharacteristics), which provide consistent terminology for specifying, measuring

and evaluating cloud services so that the stakeholders, cloud service customer (CSC), cloud service

provider (CSP) and cloud service partner (CSN) have a common understanding.

Since the quality model in this document is the extension to the existing quality models defined in

ISO/IEC 2501n, it can be used with the product quality model, IT service quality model, data quality

model, and quality-in-use model according to evaluation purposes. As there are several cloud service

categories, this document focuses on the quality model of SaaS (Software as a Service).

NOTE Future documents are intended to address PaaS (Platform as a Service) and IaaS (Infrastructure as a

Service).
2 Normat ive references

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

ISO/IEC 25000, Systems and software engineering — Systems and software Quality Requirements and

Evaluation (SQuaRE) — Guide to SQuaRE
ISO/IEC 22123-1, Information technology — Cloud computing — Part 1: Vocabulary
3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/IEC 25000, ISO/IEC 22123-1,

and the following apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1 Quality model of cl oud services
3.1.1
service performance efficiency

degree to which a cloud service meets performance requirements under stated conditions

© ISO/IEC 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 8 ----------------------
ISO/IEC TS 25052-1:2022(E)
3.1.1.1
time-behaviour

degree to which a cloud service meets the requirements of the response times and throughput rates of

a cloud service, when concurrent users take advantage of the cloud service

[SOURCE: ISO/IEC 25010:2011, 4.2.2.1, modified — “a cloud service meets the requirements of” has

been added, “a product or system” has been replaced by “a cloud service” and “when performing its

functions, meet requirements” by “when concurrent users take advantage of the cloud service”]

3.1.1.2
aggregated resource utilization

degree to which a cloud service utilizes efficiently aggregated resources from resource pooling in order

to support multi-tenancy

Note 1 to entry: Resource pooling is the feature where physical or virtual resources can be aggregated to provide

a cloud service to one or more cloud service customers.
Note 2 to entry: Resources include CPU, memory, disk and network.
3.1.1.3
capacity

degree to which the maximum limits of a cloud service’s parameters meet requirements in SLA (Service

Level Agreement)

Note 1 to entry: Parameters can include the limit of simultaneous cloud service connections, the limit of available

cloud service resources, cloud service throughput and cloud service bandwidth.

[SOURCE: ISO/IEC 25010:2011, 4.2.2.3, modified — “a product or system parameter” has been replaced

by “a cloud service's parameters” and “in SLA (Service Level Agreement)” has been added.

3.1.1.4
scalability

degree to which physical and virtual resources are available automatically and immediately, when they

are needed, subject to constraints of service agreements
3.1.1.5
elasticity

degree to which a cloud service adjusts rapidly and elastically the amount of resources that are allocated

to an instance of the service
3.1.2
service compatibility

degree to which a cloud service can exchange information with CSC’s systems or other cloud services

and/or perform its required functions

[SOURCE: ISO/IEC 25010:2011, 4.2.3, modified- “a product, system or component” has been replaced

by “a cloud service” and “other products, systems or components” by “CSC’s systems or other cloud

services”, and “while sharing the same hardware or software environment” has been deleted.]

3.1.2.1
cloud interoperability

degree to which a cloud service interacts with CSC's systems, or interacts with other cloud services, by

exchanging information according to a prescribed method to obtain predictable results

[SOURCE: ISO/IEC 22123-1: 2021, 3.7.2, modified — “ability of a CSC’s system to interact with a cloud

service, or the ability for one cloud service to interact” has been replaced by “degree to which a cloud

service interacts with CSC's systems, or interacts”]
PROOF/ÉPREUVE © ISO/IEC 2022 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC TS 25052-1:2022(E)
3.1.3
service usability

degree to which a cloud service can be used by specified users to achieve specified goals with

effectiveness, efficiency and satisfaction in a specified context of use

[SOURCE: ISO/IEC 25010:2011, 4.2.4, modified — “a product or system” has been replaced by “a cloud

service”]
3.1.3.1
accessibility

degree to which a cloud service can be accessed by a variety of client devices over a network through

standard mechanisms
3.1.4
service reliability

degree to which a cloud service performs specified functions under specified conditions for a specified

period of time

[SOURCE: ISO/IEC 25010:2011, 4.2.5, modified — “a system, product or component” has been replaced

by “a cloud service”]
3.1.4.1
availability

degree to which a cloud service is accessible and usable upon demand by an authorized entity

[SOURCE: ISO/IEC 22123-1: 2021, 3.14.7, modified — “property of being” has been replaced by “degree

to which a cloud service is”]
3.1.4.2
resilience

degree to which a cloud service recovers operational condition quickly after a fault occurs

[SOURCE: ISO/IEC 19086-1:2016, 3.19, modified — “ability of” has been replaced by “degree to which”]

3.1.4.3
recoverability

degree to which a cloud service supports its critical business functions to an acceptable level within a

predetermined period of time following a disaster

[SOURCE: ISO/IEC 19086-1:2016, 3.7, modified — “ability of the ICT elements of an organization to

support” has been replaced by “degree to which a cloud service supports”]
3.1.5
service security

degree to which a cloud service protects information and data so that persons or other products or

systems have the degree of data access appropriate to their types and levels of authorization

[SOURCE: ISO/IEC 25010:2011, 4.2.6, modified — “a product or system” has been replaced by “a cloud

service”]
3.1.5.1
confidentiality

degree to which a cloud service ensures that data are accessible only to those authorized to have access

[SOURCE: ISO/IEC 25010:2011, 4.2.6.1, modified — “a product or system” has been replaced by “a cloud

service”]
3.1.5.2
accountability

degree to which the actions of an entity can be traced back uniquely to the entity

[SOURCE: ISO/IEC 25010:2011, 4.2.6.4 — “back” has been added]
© ISO/IEC 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 10 ----------------------
ISO/IEC TS 25052-1:2022(E)
3.1.5.3
isolation

degree to which computations and data of a cloud service are isolated from and inaccessible to one

another in the situation that physical and virtual resources are shared by multi-tenants

3.1.5.4
PII protection conformance
personally identifiable information protection conformance

degree to which a cloud service conforms to the standards, laws, or regulations applied to collection,

processing and disposal of PII (personally identifiable information)
Note 1 to entry:
...