A consulting firm is engaged to assess the security controls of a company's cloud deployment and to integrate its identity provider with two SaaS applications. The firm does not host, operate or resell any cloud services. In ISO/IEC 17788 terms, which role does the consulting firm hold?
Select an answer to reveal the explanation.
Short Explanation
Think of the contractor who inspects and wires up your house but doesn't own the power company. That's a cloud service partner: it helps the customer or provider without delivering the cloud service. The trap is the word 'access': touching the configuration doesn't turn a helper into a provider.
Full Explanation
ISO/IEC 17788 defines a cloud service partner as a party engaged in support of, or auxiliary to, activities of the cloud service provider, the cloud service customer, or both. ISO/IEC 17789 describes partner sub-roles such as cloud auditor and cloud service developer, and integration work is typical partner activity. A firm that assesses controls and integrates identity without hosting or operating any service fits that definition. The provider role belongs to the party that makes cloud services available; administrative access granted for a project does not make a consultant the operator of the services or accountable for their delivery. The broker function means negotiating relationships, intermediating or aggregating services across providers, and the firm does none of that. The customer role belongs to the company in a business relationship with the providers for the purpose of using their services; the consultant works for that customer but is not the party contracting for the services. Exam caveat: one organization can hold different roles in different relationships, so classify by what it does in the scenario described. Operational check: grant the partner time-limited, least-privilege access tied to the engagement, record it, and revoke it when the engagement ends, since its access is a customer-side risk.