Source: datacenternews.asia
What Is OSPAR Attestation?
The Outsourced Service Provider Auditor Report (OSPAR) is a compliance framework established by the Association of Banks in Singapore (ABS). It defines the minimum IT security controls that outsourced service providers (OSPs) must implement before they can offer services to Singapore’s financial institutions (FIs). These controls are codified in the ABS Guidelines on Control Objectives and Procedures for Outsourced Service Providers — commonly referred to as the ABS Guidelines.
OSPAR attestation is not self-certified. It requires an independent third-party auditor to assess a provider’s security capabilities against the ABS Guidelines, covering areas such as:
- Third-party vendor management
- Technical and organisational security controls
- Information protection practices
For cloud providers operating in the Asia-Pacific financial services market, OSPAR attestation is a significant trust signal. Singapore’s Monetary Authority of Singapore (MAS) holds outsourcing arrangements at financial institutions to a high standard, and OSPAR provides a recognised mechanism for demonstrating that a cloud vendor meets those expectations.
Google Cloud’s OSPAR Achievement
As of September 2019, Google Cloud received OSPAR attestation covering 75 cloud products. According to Google, the attestation demonstrates that these services meet the requirements of the ABS Guidelines, giving Singapore’s financial institutions greater confidence when processing high-impact workloads on Google Cloud infrastructure.
In Google’s own words:
“We are happy to provide additional assurance to our financial institution customers in Singapore that Google Cloud is committed to maintaining a high level of security that meets the rigorous ABS Guidelines… Driving innovation and digital transformation in the financial services industry… [and] providing greater value and choice for the APAC region.”
The company highlighted three specific benefits of the attestation:
- Security assurance: Demonstrating that Google Cloud’s capabilities and controls — spanning vendor management, technical security, and information protection — satisfy the ABS Guidelines.
- Digital transformation enablement: Allowing financial services customers running high-impact workloads to adopt cloud computing with confidence in their data security posture.
- Greater market competition: Expanding the choices available to Singapore FIs when selecting public cloud providers and assembling their technology stack.
Full List of OSPAR-Attested Google Cloud Products
The following 75 Google Cloud products were covered under the OSPAR attestation as of the September 2019 announcement:
- Access Transparency
- AI Platform Training and Prediction
- App Engine
- BigQuery
- BigQuery Data Transfer Service
- Cloud Armor
- Cloud AutoML Natural Language
- Cloud AutoML Translation
- Cloud AutoML Vision
- Cloud Bigtable
- Cloud Billing API
- Cloud Build
- Cloud CDN
- Cloud Console
- Cloud Console Mobile App
- Cloud Dataflow
- Cloud Datalab
- Cloud Deployment Manager
- Cloud DNS
- Cloud Endpoints
- Cloud Filestore
- Cloud Firestore
- Cloud Functions
- Cloud Healthcare
- Cloud HSM
- Cloud Identity & Access Management
- Cloud Identity-Aware Proxy
- Cloud Interconnect
- Cloud IoT Core
- Cloud Key Management Service
- Cloud Load Balancing
- Cloud Memorystore
- Cloud Natural Language
- Cloud Pub/Sub
- Cloud SDK
- Cloud Security Scanner
- Cloud Shell
- Cloud Source Repositories
- Cloud Spanner
- Cloud Speech-to-Text
- Cloud SQL
- Cloud Storage
- Cloud Storage Transfer Service
- Cloud Talent Solution
- Cloud Text-to-Speech
- Cloud Translation
- Cloud Video Intelligence
- Cloud Vision
- Cloud VPN
- Compute Engine
- Container Registry
- GCP Marketplace
- Genomics
- Google Service Control
- Google Service Management
- Identity Platform
- Kubernetes Engine
- Network Service Tiers
- Orbitera
- Persistent Disk
- Service Consumer Management
- Stackdriver Debugger
- Stackdriver Error Reporting
- Stackdriver Logging
- Stackdriver Profiler
- Stackdriver Trace
- Virtual Private Cloud (VPC)
Note: The original announcement listed 75 products. The list above reflects all products named in the source article. Some product names may have changed since 2019 as Google has rebranded parts of its portfolio (for example, Stackdriver became Cloud Operations).
Why OSPAR Matters for DevOps and Cloud Teams in Financial Services
For DevOps engineers and platform teams working within Singapore-regulated financial institutions — or building products for them — OSPAR attestation has practical implications:
- Reduced audit burden: When a cloud provider holds OSPAR attestation, FIs can rely on that third-party audit rather than performing their own exhaustive assessments of each cloud service’s security controls.
- Approved service selection: Compliance and risk teams often maintain approved lists of cloud services. OSPAR-attested products are more likely to pass internal review, accelerating time-to-deployment for new workloads.
- Contractual and regulatory alignment: MAS outsourcing guidelines require FIs to conduct due diligence on cloud vendors. Vendors with OSPAR attestation provide documented evidence that simplifies this due diligence process.
- Architecture decisions: Knowing which specific services are attested helps architects scope compliant reference architectures — for example, confirming that Kubernetes Engine, Cloud SQL, and VPC are all covered under the same attestation umbrella.
Broader Compliance Context
OSPAR sits alongside a broader set of compliance certifications that cloud providers pursue for the financial services sector. Other relevant frameworks include ISO 27001, SOC 2, PCI DSS, and region-specific standards such as MAS TRM (Technology Risk Management) guidelines. For teams building in Singapore or serving Singapore-based FIs, OSPAR attestation is a key criterion but is typically evaluated alongside these other certifications.
Teams should verify the current attestation status directly with Google Cloud’s compliance documentation, as the scope of covered products evolves over time and product names may have changed since the original 2019 announcement.