Abstract: Techniques are provided for automated evidence collection. A first standard is processed to generate first collection instructions that, when executed, obtain evidence data corresponding to a first plurality of evidence types from cloud environments deployed at a cloud service provider system. A request is received to perform an audit operation, related to the first standard and a first cloud environment deployed at the cloud service provider system. First selected instructions are determined that are associated with at least one evidence type associated with the audit operation. The first selected instructions are executed to obtain first evidence data on the first cloud environment from the cloud service provider system. An audit result is determined based on the first evidence data.

Abstract: Techniques are provided for automated construction of compliant cloud environments. A first standard is processed to generate a first plurality of controls. Construction instructions are generated for automatically creating generated environments at a cloud service provider system that satisfy the first plurality of controls. A request to create a cloud environment for a first customer is received. The construction instructions are executed to provision a first generated environment at the cloud service provider system that is compliant with the first standard. Control of the first generated environment is provided to the first customer.