Standards compliance of a cloud environment is like a scientific theory in the sense that it can only be falsified. Yes, you can verify certain properties at a certain point in time, but you can't be absolutely certain that they will remain satisfied after the check or in between checks. So compliance monitoring is a trade-off, an engineering task: how many resources do you want to expend to build a certain degree of trust in the result?

This talk will provide a glimpse into the engine room of compliance monitoring at the Sovereign Cloud Stack (SCS). You will learn how SCS decomposes prose standards into testcases, how these testcases are checked at various intervals and the results tracked, what measures are taken to avoid false positives, and what, ultimately, makes a cloud compliant.