IPCEI-CIS Reference Architecture

Application Layer

It provides the functionality required to design and develop applications and functions and to expose them for use. It includes end-user applications and function catalogs. Functions/services to support its execution, the attributes that may allow the selection of the computing node to host it (hardware requirements, latency, privacy, etc.).

It also provides tools for automatic verification and validation (CV/CT) of the application and its supply chain before its final packaging.

Application Packager

The Application Packager supports the packaging of applications for their deployment in the Cloud-Edge Continuum.

It facilitates the automation of application deployment and update (DevOps, both traditional and AI-assisted), providing an integrated toolkit that enables quick, secure and innovative ways to deploy cloud-aware applications.

API Gateway

This component provides the interface to invoke and use the applications contained in the catalog. It checks the identity and authenticates the user and checks his authorization to use the application before providing access to it.

Application Monitoring

It tracks application usage and execution, monitors the performance and identifies abnormal behavior and suboptimal use of resources.

Application Catalog

It implements a directory of applications and functions that the providers have made available. contain the characteristics of the application and the environment it requires for its execution (runtime, services, hardware characteristics).

Application Accounting and Charging

This component implements the accounting of application usage and provides online charging information for the customer to track application expenditure in real-time.

Data Layer

This layer offers simple, scalable, sustainable, and trustable mechanisms for collection, processing, and exchange of data distributed over the Cloud-Edge Continuum.

Data Pipelines

This component provides the functionality for data collection, including the connectors to integrate with the data sources and the capabilities for data curation and pre-processing that ensure its quality and readiness for analytics, insight generation, training, modelling, or inferencing phases.

Data Modelling

This component enables data cataloguing to enable exposure and discovery at scale to easily search, find, and browse data, over a distributed environment.

Data Exposure

The Data Exposure component provides customers with standard mechanisms and interfaces for safe and controlled access to data. It includes capabilities for making data offers and contracting data acquisition, identity checking, and data access authentication and authorization.

Data Policy Control

Data Policy Control sets the required policies for data sharing, providing a safe, controlled and regulation-compliant environment for data exchange. It allows the data owner to manage the permissions to access its data: who can make it, at which conditions and for which purposes.

Data Catalog

Data Catalog provides efficient storage and indexing of data to facilitate browsing, searching and finding data over a distributed environment.

Data Federation

Data Federation enables standard mechanisms and interfaces (connectors) for partnering in the provision of datasets, providing a unified view of data catalogs and databases from multiple data providers.

This component enables real-time data exchange across companies using data mesh principles, connecting distributed and heterogeneous actors over the Cloud-Edge Continuum, keeping data owners in full control of their data.

In order to create and maintain a coherent federated Multi-Provider Cloud-Edge Continuum, data federation capabilities should be designed consistently with the other federation capabilities described in this document.

AI Layer

The AI layer provides a set of advanced functionalities to apply Artificial Intelligence (AI) natively across the Cloud-Edge Continuum, with distribution of data and processing resources as the default rather than an add-on to centralized cloud.

This layer facilitates the seamless integration of AI model lifecycle management into the Cloud-Edge Continuum, enabling efficient operations across distributed environments. Its capabilities are tailored to the specific characteristics of the Cloud-Edge Continuum, ensuring optimal performance and resource utilization. It provides:

• end-to-end solutions for the AI lifecycle, including preprocessing, model training, and evaluation
• inference with deployment, monitoring, operations across cloud and edge, and
• agents with tools, context interfaces, and workflows for coordinated AI execution, including governed access to external tools, resources, and data sources through agent-facing interfaces such as MCP.

The distribution of AI workloads across the cloud-edge continuum is driven by several rationales that often combine in practice:

• latency requirements for human, robotic, or industrial interaction (standard edge definition, https://digital-strategy.ec.europa.eu/en/policies/edge-observatory),
• data locality, where data must remain at its source for privacy, regulatory, or sustainability reasons,
• privacy-aware operation, where data and models stay within an edge governance perimeter unless explicit policy controls authorize their movement, and
• sovereignty over computing, where existing edge resources are orchestrated and parallelized to perform distributed training or inference without dependence on external infrastructure.

These rationales widen the operational definition of "edge" in the AI Layer beyond network-distance measures: from the AI Layer's perspective, an edge is any environment where placement is justified by latency, data locality, privacy governance, or sovereignty.

Cloud-Edge Training

This component facilitates the dynamic and adjustable training of AI models across cloud and edge environments, ensuring scalability, reduced latency, and optimized resource utilization. It covers training within a single provider's infrastructure, including distributed training where workloads are split across multiple nodes under central orchestration, and the placement of training jobs according to resource, cost, and sustainability constraints. Training that spans multiple independent providers is addressed by the AI Training Federation component.

Cloud-Edge Inference

The inference components facilitate real-time deployment and execution of trained AI models on across the cloud-edge continuum, with placement chosen to match resource availability, latency requirements, and data-governance constraints. Models run:

• at the edge when local infrastructure is sufficient and data must remain in place,
• on sovereign cloud nodes operated by a federated provider when local resources are insufficient (for example, for large language models), or
• in hybrid configurations where parts of an inference workflow are split between edge and sovereign cloud for resource optimization.

Edge deployments may apply techniques such as model quantization, pruning, or distillation to fit resource-constrained environments. Sovereign cloud and hybrid configurations may apply additional security and compliance components to fit data-governance constraints, for example ephemeral storage and secure channels protecting data in transit.

The inference plane is synchronized with the cloud for updates, monitoring, and lifecycle management. This distinguishes federated cloud-edge inference from inference delegated to AI providers outside the federation, where the model and runtime fall outside its sovereignty and governance guarantees.

AI and Agent Observability

This component provides AI-specific monitoring that complements the generic capabilities in the Management Domain. It covers model performance and drift detection, output quality signals such as hallucination indicators for generative models, inference latency, and token usage. For agentic workloads, it captures full execution traces including model calls, tool invocations, MCP and A2A interactions, handoffs, approvals, and policy decisions. Replicable traces support audit, evaluation, and post-market monitoring obligations under the AI Act.

Cloud-Edge Agent Manager

The Cloud-Edge Agent Manager enables the deployment and management of agents and agentic workflows on edge and hybrid edge-cloud deployments. It manages agent identity, exposed tools, MCP endpoints, transport, authentication requirements, tool schemas, owner, version, risk level, persistent state, policy enforcement, auditability, and observability hooks, creating an agentic mesh that can be operated across providers.

Federated discovery of agents and MCP endpoints across providers is enabled in coordination with the Federation Domain, preserving endpoint identity, authorization, versioning, data residency, and audit requirements.

AI Training Federation

AI workloads can be split across multiple nodes with central orchestration for scalability and operational efficiency (distributed AI). AI federation enables autonomous nodes to collaborate securely, ensuring privacy and sovereignty. Together, they balance task-sharing efficiency with autonomy.

In distributed AI training, the AI model is generated at a central point based on the combination of models produced by different training agents distributed across an ecosystem of federated AI service providers or owners. The distributed training agents work locally on local datasets, reducing the need to transfer data to a central location for training.

This component allows users to use and orchestrate AI resources across multiple providers to collaboratively perform a specific machine learning training task. It leverages a federated network of AI capabilities geographically distributed across the Multi-Provider Cloud-Edge Continuum, enabling accessible resource sharing and scaling while maintaining sovereignty and compliance. It ensures efficient distribution of AI computational workloads, minimizes data movement, and facilitates parallel model training without requiring centralized data aggregation, thus preserving data privacy and autonomy while enhancing overall system performance.

In order to create and maintain a coherent federated Multi-Provider Cloud-Edge Continuum, federated learning capabilities should be designed consistently with the other federation capabilities described in this document.

AI Model Catalog

The AI Model Catalog holds trained models available for deployment across the Cloud-Edge Continuum, spanning the full range of model types: classical machine learning models (such as regression and tree-based models), task-specific deep learning models (such as vision and speech models), and foundation models (LLMs, SLMs, and multimodal models). For each model it maintains metadata supporting discovery, versioning, provenance, licensing, and intended use, enabling applications and orchestration components to select appropriate models for a given task and deployment context.

Models can be fine-tuned and adapted to specific use cases using techniques such as RAG, quantization, pruning, or distillation. Model selection often balances capability against resource footprint, which is particularly relevant at the edge, where smaller and specialized models may be preferred.

As one notable example, the catalog includes multilingual and multimodal foundation models tailored to diverse EU languages and data types. These address the scarcity of generative AI solutions in non-English languages, supporting semantic precision and completeness, with metadata that supports AI Act compliance.

AI Explainability and Governance

This component ensures transparency, accountability, and regulatory alignment of AI systems across the Cloud-Edge Continuum. It provides interpretable insights into AI decision-making, maintains model cards and technical documentation, and supports risk classification and compliance with the AI Act. Decision logging and audit trails enable human oversight and post-market monitoring, while respecting privacy and data sovereignty.

Service Orchestration

The service orchestration refers to the integration and management of multiple cloud and edge services and applications in a unified and automated way across diverse multi-provider environments. In the context of multi-cloud and edge ecosystems, service orchestration is essential for handling the complexities of deploying and managing applications at scale, especially when dealing with distributed resources across cloud and edge infrastructures.

Service Orchestrator

Service orchestration assures efficient tasks execution, load balancing, and real-time operations. For example, it could communicate with the Multi-Cloud Orchestrator (cf. Section 3.9.1) that manages the virtualized infrastructure layer offering a single unified environment for application development and monitoring. This allows applications and services to be deployed seamlessly across multiple platforms, optimizing resource allocation and reducing operational complexity. Alternatively, the Service Orchestrator may directly or indirectly interact with the underlying capabilities of the cloud platform or virtualization management layer to orchestrate workload execution.

The Service Orchestrator automates application and tenant deployment, and lifecycle management processes. By automating these workflows (or service function chains), orchestration ensures that services communicate efficiently across the Cloud-Edge Continuum.

Application Performance Management

It monitors the performance and resource consumption of the application or service and communicates deviations from set thresholds or SLAs to the Service Orchestrator for this to take actions to recover a state that meets application requirements.

It provides a unified view of states, including logging, monitoring, and alerting, for effective real-time application management and validation at runtime.

Application Repository

This component tracks the applications and services that have been deployed and their configuration, the locations where the application and service components are installed, and the resources they are consuming.

Service Federation

This component interconnects the Service Orchestrator with those of other federated providers, enabling the deployment and execution of applications (service function chains) across multiple providers in a seamless way, interacting with a single provider.

In order to create and maintain a coherent federated Multi-Provider Cloud-Edge Continuum, Service Federation capabilities should be designed consistently with the other federation capabilities described in this document.

Cloud Edge Platform

The Cloud-Edge Platform Layer hosts components that manage and orchestrate runtime environments (virtual machines, containers, serverless) and platform resources (libraries, functions, services, security, databases, tools). The platform services (PaaS) it provides support the deployment of applications and the corresponding runtime environments and platform resources.

Multi-Cloud Orchestrator

MCO delivers a PaaS service. A PaaS provides a complete application development and deployment environment in the cloud. With PaaS, customers can build, test, deploy, manage, and update applications quickly and efficiently, without worrying about the underlying infrastructure.

It receives from the Service Orchestrator (cf. Section 3.8.1) a request to deploy (or manage the lifecycle of) a certain application together with a descriptor (resource model) that defines the state the application needs for its execution (including runtime environment, services, data, application image and other attributes like area of service, performance...). The MCO processes the state and takes actions to set it up and preserve it, by updating, upgrading, or removing workloads and services, or rescaling or releasing resources.

MCO works in close relationship with other components (Physical Infrastructure Manager – PIM, Virtual Infrastructure Platform Manager – VIP, Multi-Cluster Manager – MCM, Serverless orchestrator) to provide the virtual runtime environment defined for the application, the specific combination of bare metal, virtual machine, containers, and serverless mechanisms, it has been developed to run on, using the technologies over which it has been tested and certified.

MCO also deploys and manages the lifecycle of essential tools and services such as middleware, development frameworks, databases, and business analytics, enabling organizations to streamline application development and drive innovation.

A PaaS, managed by the MCO, offers scalability, high availability, and reduced time-to-market, allowing developers to focus on coding and application functionality while the MCO supports with infrastructure, security, and operational aspects.

Based on certain attributes, like area of service and performance, the MCO may select the location(s) where to deploy the workload and the resources (physical and virtual) required at those location(s) to meet the desired state. This decision on application placement can also follow sustainability and privacy requirements.

The MCO deploys the workload once the necessary resources are available, using the Workload Deployment Manager (WDM). The MCO also updates and removes workloads, rescaling or releasing the corresponding resources.

This MCO description shows a decomposition of the functionality of a Cloud-Edge Continuum workload management solution that may be implemented in many ways, combining or excluding some of its components in order to fit specific sector needs.

Cloud-Edge Connectivity Manager

The Cloud-Edge Connectivity Manager (CEC) implements and modifies the service function chain, or removes it, totally or partially, following the requests from a Service Orchestrator, to guarantee the connectivity between workloads that will enable the service delivery and the connectivity from the service user to the workloads implementing the service front-end.

Connectivity is usually based on both overlay and underlay components in each domain crossed by the traffic (e.g. WAN, data centers, etc.). The CEC manages the networking in the data center domain through the virtualization managers (Virtual Infrastructure Manager – VIM, Container Infrastructure Service Manager – CISM) or via specific Network as a Service (NaaS) interfaces. It manages the WAN connectivity using cloud networking services (via transport SDN Controllers) for the connection of different computing nodes.

In addition, the CEC manages the complexity deriving from the need to ensure consistency between overlay and underlay networking solutions (for example adapting the networking between the data center fabric and the WAN connectivity).

Physical Infrastructure Manager

The PIM monitors and manages a pool of physical resources (CPUs, storage, networking) and selects and prepares them (with the corresponding OS and necessary software) to allocate these resources to a virtual machine or container cluster.

The PIM provides multiple physical infrastructure management functions, including physical resource provisioning and lifecycle management, physical resource inventory management, or physical resource performance management.

Multi-Cluster Manager

The MCM creates and configures container clusters both over bare metal and over virtual machines upon request from the MCO, offering a single interface to manage infrastructure from multiple providers and with multiple k8s distributions.

The MCM provides open connectors/APIs to interact with the resources and k8s distributions offered by different providers (private and public) for cluster creation, configuration, and monitoring, and keep track of their evolution.

The MCM may create a k8s cluster on bare metal (cluster nodes are servers) or on the virtualization stack (cluster nodes are VMs), interacting with PIM or VIP respectively.

Virtual Infrastructure Platform Manager

The Virtual Infrastructure Platform Manager (VIP) creates virtual machine clusters across several locations using the resources allocated by the PIM.

The VIP is required when the service component to be deployed is a virtualized application or a containerized application, which runs over container clusters that make use of VMs (virtual machines).

This component works on infrastructure and technology from different providers, enabling the Cloud-Edge Continuum to run on a diverse set of different virtualization solutions (VIMs, CISMs, or any other future virtualization technology).

Workload Deployment Manager

The WDM deploys software package(s) on top of an existing cluster, following the request of the MCO. It exposes a single interface to deploy software packages (i.e., via a helm chart or resource model declaration) on any k8s cluster (or alike) based on any distribution.

The WDM provides the connectors/APIs to interact with existing clusters in different locations and technologies (k8s distributions) for application deployment and lifecycle management.

This component can also deploy software packages directly on virtual machines (IaaS).

Cloud-Edge Federation

This component interconnects the MCO with the ones of other federated providers, enabling the consumer to use cloud-edge computing services (IaaS, CaaS, PaaS, Serverless, NaaS, ...) across multiple providers seamlessly, interacting with a single provider.

This platform federation provides seamless integration and collaboration between multiple cloud platform providers, enabling interoperability, resource sharing, and unified lifecycle management. Shared resources may exist on all layers of cloud architecture.

By adopting standardized protocols and interfaces, platform federation facilitates enhanced scalability, efficiency, and innovation across different cloud environments while maintaining autonomy and security for each participating entity.

In order to create and maintain a coherent federated Multi-Provider Cloud-Edge Continuum, cloud-edge federation capabilities should be designed consistently with the other federation capabilities described in this document.

Cloud-Edge Access Control

This component implements a key aspect in terms of security in the management of cloud-edge infrastructure, a role-based access control that ensures proper access rights and security across the infrastructure.

Cloud-Edge Resource Inventory

This component keeps a record of the resources available in each of the edge locations, the virtualization platforms available, and the configuration. The information in this repository helps the MCO to select the right location(s) to deploy workloads.

Workload Inventory

This component keeps record of the workloads that have been deployed and their configuration, as well as information about the location and cluster where they have been deployed and the resources they are consuming.

Serverless Orchestrator

The Serverless Orchestrator provides serverless capabilities, also known as Function as a Service (FaaS), which is a cloud computing model that allows developers to build and deploy applications in the form of individual functions, that are executed in response to specific events or triggers. This model eliminates the need to manage server infrastructure, enabling developers to focus solely on writing code. Each function runs in a stateless container, automatically scaling with demand and only consuming resources when invoked, leading to cost savings and efficient resource utilization.

Virtualization

The Virtualization Layer in cloud infrastructures acts as a crucial abstraction layer that enables the efficient utilization of physical resources by creating multiple virtual instances of servers, storage, and network resources. This layer leverages hypervisors or related technologies to decouple hardware from the operating system, allowing for the dynamic allocation and scaling of resources based on demand. By providing a flexible and scalable environment, the virtualization layer enhances resource optimization, simplifies management, and supports the seamless deployment of various cloud services and applications. This foundational component is essential for delivering IaaS and other cloud service models, ensuring agility, cost-effectiveness, and high availability.

Hardware Resource Manager

The Hardware Resource Manager component delivers a Bare Metal as a Service (BMaaS) service. BMaaS is an abstraction that provides physical, non-virtualized hardware resources directly to users, offering dedicated servers, storage, and networking components without any virtualization layer. This service allows users to harness the full power of the hardware for applications, resulting in higher performance, predictable latency, and complete control over the environment. BMaaS is particularly beneficial for workloads that require intensive computation, low-latency networking, or compliance with specific hardware configurations.

Virtual Infrastructure Manager

The VIM component provides IaaS service. IaaS is a cloud computing model that provides virtualized computing resources. IaaS delivers essential services such as virtual machines, storage, and networks. Users can provision, scale, and manage the resources dynamically according to their needs, while the cloud provider takes care of maintaining the underlying hardware, networking, and security. This model offers high flexibility, enabling organizations to quickly deploy and run applications and services, test new solutions, and handle varying workloads with ease, ultimately driving innovation and operational efficiency.

Container Infrastructure Service Manager

The CISM component provides a CaaS service. CaaS is a cloud service model that provides a platform allowing users to manage and deploy containerized applications and workloads. By leveraging container orchestration tools such as Kubernetes, CaaS facilitates the automation of container deployment, scaling, and operations, ensuring high availability and performance. This model abstracts the underlying infrastructure complexities, enabling developers and IT teams to focus on application and service development and deployment without worrying about the maintenance of the physical or virtual infrastructure.

Virtual Resource Access Control

As in the cloud-edge platform layer, this access control component implements virtual infrastructure management security, a role-based access control that ensures proper access rights and security for virtual resource management.

Virtual Resource Inventory

This component keeps records of cloud-edge sites and the configuration and availability of virtual resources in each one of them (for instance, number of k8s clusters available per site, CPU/memory available per k8s cluster, number of virtual CPUs that are available to setup new k8s clusters, ...) in order to help make decisions on workload placement

Physical Cloud Edge Resources Layer

It includes all the physical hardware resources required to implement the Cloud-Edge Continuum (compute, storage, and networking). It is closely connected to the physical network infrastructure that supports communication among the computing nodes in the continuum and the connectivity of users to that continuum.

Compute

Compute resources are fundamental to cloud infrastructure, delivering the computational power required for running applications and services. They facilitate scalable and efficient environments that dynamically adjust to varying workloads, thus enhancing resource utilization and performance while minimizing costs.

Storage

Storage is essential in cloud infrastructure, providing data persistence, management, and accessibility. It includes block storage for databases, object storage for unstructured data, and file storage for shared access applications. Advanced technologies like SSDs and distributed file systems ensure scalability, reliability, and performance.

Networking

Hardware networking resources in a cloud-edge location include routers, switches, load balancers, and firewalls. These components form the backbone of data center connectivity and inter-server communication. Network Interface Cards (NIC) in servers enable high-throughput connections to the virtual network. WAN gateways and edge routers extend connectivity to external networks, supporting hybrid cloud and remote access scenarios. All hardware is managed centrally through SDN controllers and scaled dynamically to support edge-cloud service demands.

Hardware Infrastructure Manager

A Hardware Infrastructure Manager (also known as Data Center Infrastructure Management system, DCIM4) is a management component designed to monitor, measure, and manage the IT equipment and infrastructure within a cloud-edge data center. It encompasses the following key aspects:

• Monitoring and Management: It provides real-time monitoring of data center operations, including power usage, cooling efficiency, and physical security. This helps in optimizing the performance and efficiency of the data center.
• Documentation and Planning: It maintains detailed documentation of the data center's physical and virtual assets. This includes layout planning, capacity management, and future expansion plans.
• Risk Management: By continuously monitoring environmental conditions and equipment status, it helps in identifying potential risks and mitigating them before they lead to failures.
• Integration with IT Systems: It integrates with other IT management systems to provide a holistic view of the data center's operations, facilitating better decision-making and resource allocation.
• Sustainability and Compliance: It supports sustainability goals by optimizing energy usage and ensuring compliance with industry standards and regulations.

Hardware Resource Inventory

This component keeps records of cloud-edge locations and the configuration and availability of physical hardware resources in each one of them (for instance, number of servers per location, type of servers, type of NIC cards available per location, cost of resources, energy consumption of resources, ...) in order to help make decisions on workload placement and resource lifecycle management.

Physical Network Resources

Dettagli sulle Physical Network Resources...

Sustainability Domain

The sustainability components in the ICRA enable significant gains in energy efficiency and energy flexibility of the cloud-edge continuum. Sustainability is a large topic. Within the ICRA scope, focus is on operational aspects of the ICRA: emission reduction and stretching energy savings. Other topics such as material usage, product life cycle, water usage, social sustainability, etc. are left out of scope but might be included in further versions. In scope is 1) getting insights into and 2) control over the sustainability of each component in each layer in the ICRA, including heat reuse, green power and electricity net congestion mitigation.

Adding sustainability to a component can influence the component's design and operation. It does in principle not affect the function of the component, but it makes that component more sustainability aware by providing insight into its energy consumption and by making it more efficient to reduce its energy consumption.

There are two drivers to make sustainability-related investments for components: economic and societal. For the economic driver there must be a positive business case by itself: the benefits need to outweigh the costs of implementing the efficiency measures. The societal driver typically results in governmental (EU/national) regulations to create a level playing field amongst all providers of the same functionality. Regulations make organization change in the societal desired direction. They also create a level playing field for the necessary investments, allowing companies to create an acceptable economic environment.

Each component development in the whole ICRA should consider and, if possible, provide sustainability insights, and sustainability improvements for the component. Insight is important to facilitate awareness for its consumers. It can be done at the level of the whole component, but preferably on the level of each consumer of the component. For example, these insights can be at the whole component level of a hypervisor or at the consumer level for each VM hosted by the hypervisor. Improvement is important to lower overall energy consumption, CO2 emissions and efficiency enhancements, thereby increasing the sustainability of the component.

Benchmark, Metrics, and Monitoring

This component sets the standards for monitoring services required to support environmental targets and energy cost reduction, as well as financial optimization of ICRA services and infrastructure.

Optimizing energy consumption and carbon emission

This component can be used to implement mechanisms to optimize energy consumption and carbon emission of each component and each layer in the ICRA and its corresponding services. Energy consumption and carbon emissions can be optimized in each component in each level of the ICRA, as long as enough information (insight) is available at that level and there are enough sustainability options for the used services to adapt where necessary.

Renewable Energy Management

This component’s purpose is to ensure that the optimal amount of renewable (green) energy is used for powering datacenters. There are many aspects that can play a role in this: CO2 emissions, Certificates, CO2 attribution, batteries, local production and net congestion mitigation.

Cooling and Heat Management

This component enhances energy and operational efficiency through:

1. Efficient next-generation (immersion and liquid-based) cooling technologies to increase cooling efficiency, to reduce energy consumption, and to support high-density computing.
2. Functionality to enable recovery, upgrade, and reuse of heat energy from cooling systems within data centers, and the subsequent storage and exploitation of the recovered heat.
3. Functionality to support the selection of data center locations to benefit from natural environments factors such as cool climates and other natural cooling opportunities.

Security and Compliance

The CSF aims to establish a unified approach to security across the IPCEI-CIS project by fostering collaboration among partners. This framework identifies and standardizes security components, promotes interoperability, and ensures baseline security compliance across all identified 8ra security topics.

This proactive approach to security and compliance is essential for fostering trust and reliability in cloud services.

Since the security and compliance domain requires an all-encompassing view, the CSF is based on 10 major topics listed.

• Identity & Access Management (IAM)
• Decentralized Identity (DID)
• Role-Based Access Control (RBAC)
• Zero Trust Architecture (ZTA)
• Multi-Factor Authentication (MFA) and biometrics
• Identity federation (OAuth 2.0, OpenID Connect)

This domain focuses on controlling and verifying identities and their access to resources across the Cloud-Edge Continuum. It encompasses capabilities like decentralized identity, role-based access control, multi-factor authentication, and identity federation. The CSF delivers a unified approach for IAM by classifying all partner-contributed identity solutions and mapping them into the Reference Architecture. This ensures consistent application of Zero Trust principles for access, clear alignment of each IAM component to the overall security architecture, and a baseline set of identity services that all partners can leverage and trust.

Network Security

• Firewalls and Segmentation
• VPN and IPsec tunnels
• Secure DNS (DoH/DoT)
• Intrusion Detection/Prevention (IDS/IPS)
• Secure routing and path validation

Network Security covers the protection of data in transit and the defense of network infrastructure. This includes DDoS protection, firewalls, secure network segmentation, encrypted communications (e.g., VPN/IPsec tunnels), intrusion detection/prevention systems, and secure routing protocols. The CSF consolidates and classifies network security components provided by different partners, integrating them into a cohesive multi-provider network defense strategy. By mapping each solution from secure DNS to DDoS mitigation into the framework, the CSF ensures that the entire Cloud-Edge Continuum benefits from a coordinated network security posture, and it identifies any gaps where additional controls or partner contributions may be needed.

Data Security

• End-to-End Encryption (E2EE)
• At-rest and in-transit encryption
• Data loss prevention (DLP)
• Key management systems
• Post-quantum cryptography

Data Security is concerned with protecting data at rest, in transit, and in use. It spans end-to-end encryption, DLP measures, robust key management systems, and emerging techniques like post-quantum cryptography. The CSF delivers classifications of all data protection mechanisms across partners, establishing common standards for encryption and data handling throughout the platform. By mapping partner contributions (e.g., encryption services or key vaults) to this domain, the framework ensures consistent data confidentiality and integrity measures are applied project wide. It also helps in verifying that each partner’s solutions meet compliance requirements for data privacy and that any critical gaps (such as missing encryption capabilities) are addressed collaboratively.

Application Security

• Secure coding practices
• Static and dynamic analysis
• Web Application Firewall (WAF)
• API security
• Software Bill of Materials (SBOM)

This domain addresses the security of software applications and services, including their development and runtime protection. It involves secure coding practices, code analysis (static and dynamic testing), application firewalls like WAF, API security, and the use of SBOM to track components. The CSF maps and classifies all application security tools and practices contributed by partners for example, cataloging code scanning tools or runtime protection modules to ensure that they align with the Reference Architecture’s application layer. By doing so, the CSF facilitates a baseline for secure software development and deployment across the project. Partner contributions are integrated so that vulnerabilities are identified early, common security standards like OWASP Top 10 mitigations are followed, and all applications in the IPCEI-CIS ecosystem benefit from a robust and consistent security posture.

Endpoint & Device Security

• Secure OS and firmware
• Device identity and attestation
• Mobile device management (MDM)
• IoT security frameworks

Endpoint and Device Security focuses on protecting the multitude of devices and nodes from user devices to edge hardware and IoT sensors that connect to the cloud-edge environment. This includes secure operating systems and firmware, device identity and attestation mechanisms such as using TPM/HSM hardware roots of trust, MDM, and IoT security frameworks. The CSF classifies partner contributions in this area to build a comprehensive device security layer within the framework. It will deliver an integrated approach where solutions like secure boot processes, remote attestation services, and device management tools are mapped to the appropriate architecture layers. By aligning these contributions, the CSF ensures that all endpoints in the federation, regardless of provider, meet a common baseline of trustworthiness and that device-level threats are mitigated through coordinated controls and monitoring.

Security Operations (SecOps)

• Continuous monitoring and logging
• SIEM systems – threat detection and response
• Automated incident response
• Red team/blue team exercises

This domain covers the operational aspects of security, including continuous monitoring, threat detection, incident response, and security assurance activities. It involves SIEM systems for centralized logging, alerting, and analytics, automated threat response or SOAR playbooks, and regular exercises (red team/blue team) to test defenses. Through the CSF, partners’ SecOps tools and services will be identified and integrated into a unified operational security framework. The CSF delivers a coordinated approach to monitoring and incident handling. Examples include ensuring that logs and alerts from all components feed into a common analysis platform and establishing joint incident response procedures. By mapping each partner’s monitoring and response capabilities, the framework improves overall situational awareness and ensures that security events anywhere in the continuum can be detected and addressed quickly through collaborative efforts.

Governance, Risk & Compliance

• Security policy management
• NIST/ISO compliance
• Risk assessments
• Privacy regulations (e.g., GDPR, CCPA)
• Audit logging and forensic readiness

Governance, Risk and Compliance (GRC) encompasses the policies, processes, and oversight needed to manage security risks and ensure compliance with standards and regulations. This includes security policy management, risk assessment methodologies, audits and reporting, and adherence to frameworks like ISO 27001 or industry-specific standards. Within the CSF, all partner contributions related to governance and compliance, such as policy frameworks, audit tools, or compliance checkers, are cataloged and harmonized. The CSF delivers a baseline security policy framework developed in collaboration with all partners, aligning everyone with common compliance requirements, for example, GDPR for privacy or national cloud security guidelines. By classifying each component’s compliance posture and mapping it to the relevant controls, the framework helps identify any regulatory gaps and ensures that risk management is a shared responsibility. This unified approach to GRC builds trust among partners and stakeholders by demonstrating that the entire platform adheres to high security standards and well-known best practices.

Resilience & Availability

• DDoS mitigation
• Redundancy and failover
• Disaster recovery planning
• Chaos engineering
• SLA for uptime

This domain focuses on keeping services reliable and available even under adverse conditions. Key aspects include DDoS mitigation strategies, redundancy and failover mechanisms, disaster recovery planning, and even techniques like chaos engineering to test system robustness. The CSF integrates and classifies all measures related to resilience contributed by partners, delivering a comprehensive continuity strategy for the project. This involves mapping out how each partner’s components achieve high availability, for example, identifying which services have built-in failover or backup, and how they interconnect across providers. By coordinating these strategies, the CSF ensures that critical cloud-edge services maintain agreed SLAs for up-time and that recovery procedures are in place. The framework will highlight any weaknesses in continuity, such as single points of failure and facilitate joint improvements, thereby enhancing the overall reliability of the multi-provider environment.

Privacy & User Control

• Privacy-by-design principles
• Consent management
• Differential privacy
• Data minimization practices

Privacy and User Control is dedicated to protecting personal data and upholding user rights across the system. It includes enforcing privacy-by-design principles, managing user consent and data preferences, implementing data minimization, and techniques like differential privacy for data analysis. The CSF delivers a consolidated view of how each partner’s solutions address privacy concerns, classifying these measures and ensuring they are embedded into the architecture from end to end. All partner components will be mapped against privacy requirements, for instance, whether they properly handle consent or anonymize user data, and the CSF identifies any gaps where additional controls are needed. By collaboratively developing a privacy questionnaire and a baseline aligned with regulations like GDPR, the framework guarantees that user data is handled transparently and that users maintain control over their information. This unified stance on privacy fosters user trust and compliance with legal mandates throughout the IPCEI-CIS platform.

Emerging & Future Threats

• Quantum-resistant encryption
• AI-driven threats
• Autonomous agents and smart contracts
• Satellite and mesh network security
• Biological and neuro-network interfaces
• Agent/tool interface security

This forward-looking domain addresses the need to anticipate and guard against evolving security challenges. It covers preparation for threats on the horizon such as quantum-computing attacks and the need for quantum-resistant encryption, AI-driven or autonomous attacks, vulnerabilities in novel technologies like smart contracts or satellite/mesh networks, and even potential bio/neuro-technology risks. In the Emerging and Future Threats domain, priority should be given to building federated threat intelligence capabilities that empower every IPCEI-CIS participant to proactively recognize and respond to existing and novel risks. Secure data sharing agreements and trust frameworks must enable partners to exchange timely threat information without compromising sovereignty. This approach will turn isolated insights into coordinated threat defense and establish a unified strategy to anticipate and counter new cyber threats across the European cloud-edge ecosystem. The CSF coordinates research and development efforts among partners to identify and classify solutions for these emerging threats, ensuring that the security architecture remains adaptive. Concretely, the CSF maps partner contributions, such as experimental quantum-resistant cryptography implementations or AI-based threat detection tools into the framework. By doing so, it delivers a strategy for continuous innovation in security: as new threats are identified, the framework can evolve by incorporating new controls or best practices. This collaborative approach means that the project is not just reacting to current threats but actively preparing for future challenges as a unified front.

Management

Effective management of cloud infrastructure necessitates a comprehensive suite of capabilities to ensure optimal performance, security, and compliance. Together, these management capabilities form an integrated framework that supports the scalability, efficiency, and security of cloud services, driving both operational excellence and strategic value.

Logging

Logging in cloud infrastructures refers to the systematic recording of events, transactions, and activities within the cloud environment. This process captures detailed logs of user actions, system operations, and data interactions, creating a repository of information that supports monitoring, auditing, troubleshooting, and security analysis.

By maintaining comprehensive and accurate logs, cloud providers and users can trace system behaviors, detect anomalies, and swiftly respond to incidents. Effective logging not only aids in compliance with regulatory requirements but also enhances the overall transparency, reliability, and resilience of the cloud infrastructure.

Monitoring and Alerting

Monitoring and Alerting in cloud infrastructures involves continuous observation and real-time analysis of system performance, application behavior, and resource utilization. This process employs various tools and techniques to collect and analyze data from different components of the cloud environment, such as servers, networks, and applications (running on cloud, edge, or far edge devices).

By setting static or AI-supported thresholds and rules, monitoring systems can detect anomalies, performance bottlenecks, and potential failures. When these conditions are met, alerting mechanisms are triggered to notify administrators and stakeholders promptly, enabling swift resolution and minimizing downtime. Effective monitoring and alerting are essential for maintaining the reliability, availability, and overall health of cloud and edge services, ensuring optimal user experiences and adherence to SLAs.

Logging, monitoring, and alerting are foundational, providing detailed records and continuous observation of system activities, which support troubleshooting, security analysis, performance optimization, and pro-active intervention. Coupled with alerting mechanisms, they enable real-time detection and swift resolution of anomalies and potential failures, ensuring high availability and reliability.

Logging, monitoring, and alerting could use artifacts from the Data layer to implement its functionality.

Accounting and Charging

Accounting and Charging in cloud infrastructure and services refers to the systematic process of tracking and invoicing the usage of cloud services by users and applications. Accounting involves the continuous collection of data on resource consumption, such as CPU usage, memory allocation, storage, and network bandwidth. This data is then analyzed to generate detailed usage reports, which serve as the basis for customer billing. Charging systems apply predefined pricing models and rates to the metered data, ensuring accurate and transparent charges based on actual usage. This process not only provides customers with clear insights into their cloud expenditures but also enables providers to manage resources efficiently and optimize their service offerings.

Effective accounting and charging are essential for tracking resource consumption and generating accurate accounting, fostering transparency. This is critical for maintaining financial accountability, fostering trust, and supporting the scalable and on-demand nature of cloud services.

Performance Management

Performance Management in cloud stack refers to the comprehensive process of defining, monitoring, and enforcing SLAs between cloud service providers and their customers. This applies also to internal performance goals the providers may set for their services.

This involves setting clear expectations for service performance, availability, and support, and ensuring that these commitments are met consistently. SLA management includes tracking key performance indicators (KPIs), generating compliance reports, and addressing any deviations through corrective actions. Effective performance management not only enhances customer satisfaction and trust but also enables providers to maintain high standards of service quality and reliability, thereby fostering long-term business relationships and competitive advantage.

The management of SLAs ensures that performance and availability commitments are consistently met, enhancing customer satisfaction and trust.

Fault Management

Fault Management in cloud infrastructures involves systematic detection, isolation, and resolution of faults or issues within the cloud environment. This process includes identifying potential failures, diagnosing their root causes, and implementing corrective actions to restore normal operations. Fault management leverages workflow and ticketing systems combined with automated tools and techniques to monitor system components, analyze error logs, and trigger alerts for anomalies. By proactively managing faults, cloud providers can minimize downtime, enhance system reliability, and ensure continuous service delivery, ultimately contributing to the overall robustness and resilience of the cloud infrastructure.

Fault management processes detect, diagnose, and resolve issues promptly, contributing to the resilience and robustness of the cloud environment.

Catalog/Repository Management

It provides inventory information, in different layers, about resources used and available and services available and deployed to make decisions. For instance, list of Kubernetes (k8s) clusters available (with characteristics) and list of applications deployed (in which cluster). In addition, catalogs enable the implementation of a model-driven approach for services and resources.

Operation Automation

This component provides automation for integration, delivery, verification, testing, optimization, and other processes in cloud-edge environments. It allows us to manage distributed software and infrastructure in an automated way (by code, by software, scripting, declaratively) reducing human errors, making implementations more uniform and predictable and facilitating the reconciliation and recovery to a working configuration after a misconfiguration, disaster, or failure. It is usually referred to as XOps (DevOps, MLOps, AIOps, FinOps...).