In our previous articles, we introduced CloudFerro’s role in EMERALD Pilot 2, described the preparation of the test environments, and presented the overall Pilot 2 workflow. Building on these articles, we now turn to a practical use case showing how AMOE (Assessment and Management of Organisational Evidence) can help with organisational security assessments.

While technical controls can often be checked using data collected from cloud infrastructure, organisational controls typically rely on evidence contained in policies, procedures and other documents. Finding the exact passage relevant to a security requirement can be time-consuming, especially during a full audit involving many controls and extensive documentation.

To illustrate this challenge, we used BSI C5 control PSS-08 – Roles and Rights Concept, focusing on its need-to-know aspect and the associated metric NeedToKnowPolicyPresence. AMOE processes the uploaded policy document and identifies the passage relevant to the selected requirement, helping users find what they need without manually searching through the entire file. This can substantially reduce the effort required to locate supporting evidence, particularly when the same task must be repeated across numerous documents and controls. The extracted passage remains subject to human review.

BSI C5 controls and metrics in Pilot 2

EMERALD already provides the BSI C5 certification scheme, including its controls and associated or proposed metrics that can be used to support their assessment. Users can explore the control descriptions and review the corresponding metrics directly in the EMERALD interface.

Figure 1. BSI C5 control PSS-08 (Roles and Rights Concept) in the EMERALD UI.

Figure 2. Associated and proposed metrics displayed in the BSI C5 mapping view.

For Pilot 2, we created our own tailored certification scheme, “BSI C5 pilot 2 v1”, based on a selection of BSI C5 controls. We use this pilot-specific scheme in our audit scope to validate the EMERALD workflow on the controls selected for the demonstration, rather than attempting to assess the entire BSI C5 catalogue.

Figure 3. Pilot 2 audit scope using the tailored “BSI C5 pilot 2 v1” certification scheme.

A practical example: PSS-08 and need to know

One of the selected controls is PSS-08 – Roles and Rights Concept. It addresses how cloud users’ roles and access permissions are defined, including the principles need to know.

Imagine that a Compliance Manager needs to locate the section of a lengthy internal policy describing access permissions and the need-to-know principle. In a manual review, this could require reading or searching through many pages before identifying a passage that is relevant to PSS-08.

In our demonstration, we upload an anonymised example policy PDF to the Target of Evaluation and select the organisational metric NeedToKnowPolicyPresence. AMOE processes the document against this selected metric, looking for a passage relevant to the requirement.

Figure 4. Uploading a policy document and selecting the NeedToKnowPolicyPresence metric.

The result is presented in the EMERALD UI, where the user can inspect the extracted evidence and open its surrounding context. In our example, AMOE highlights the “Need to know” passage within the document and marked metric as “Compliant”. However, this is only hint from the tool and the final confirmation is done by Compliance Manager. The remaining policy content is anonymised in the screenshot for security reasons.

Figure 5. AMOE detected proper section in document and marked metric as “Compliant”.

Figure 6. AMOE highlights the relevant “Need to know” passage within an anonymised document.

The important point is not that the tool replaces the policy review. It helps users get to the relevant place in the document much faster. For a Compliance Manager, this approach can simplify evidence preparation and reduce the time spent searching across lengthy policies and procedures. For an Auditor, it can provide a direct starting point for reviewing the passages relevant to a particular control, without having to locate them manually in the full document.

AMOE supports the assessment process; it does not make the final compliance decision on its own. The extracted evidence still requires human review and confirmation, especially when assessing whether a document genuinely satisfies a security requirement.

The audit view then brings the selected control and its metric-level assessment information together, making it easier to see which metrics have supporting evidence and which still require attention.

Figure 7. Audit view of PSS-08 showing assessment information for individual organisational metrics.

This example illustrates an important aspect of Pilot 2: EMERALD is not only about automating technical checks. Together with technical evidence collection from the cloud environment, AMOE helps address the documentation-heavy side of compliance work. Both types of evidence can contribute to a more structured and efficient assessment process.

For CloudFerro, this is a practical opportunity to evaluate how EMERALD could support evidence preparation and audits less time-consuming.