CSP and/or compensate the Cloud Customer through Service Credits; and 3.7.5.3 in the case of liability for information security breaches or information leakage, limit their liability if the Cloud Customer (i) opts for an ‘own coverage’ solution, provided that such an option is offered by the CSP, or (ii) declines the redundancy or other solutions lawfully offered by the CSP to reduce information security risks. 3.7.6 Without limiting Article 3.7.5, CSPs may exclude or limit their liability to Cloud Customers that are not individual consumers to whatever extent the CSPs and those Cloud Customers agree in a Cloud Contract. 3.8 Quality and Industry Standards 3.8.1 CSPs registered with the Commission must: 3.8.1.1 Inform their Cloud Customers, upon request, of the actual levels of achievement of any SLA requirements (if applicable) for the last 12 months or the period since the start of the Cloud Contract, whichever is shorter; 3.8.1.2 inform their Cloud Customers, upon request, of any certification systems or standards that these CSPs meet with regard to their Cloud Services to the relevant Cloud Customer; 3.8.1.3 comply with any certification schemes and/or standards (including encryption standards) that may be defined as mandatory by a Commission decision with regard to the type of Cloud Services provided by that CSP; 3.8.1.4 comply with any rules or guidelines adopted by the Commission with regard to business continuity, disaster recovery and risk management. 3.8.2 Encryption by Cloud Customers or Cloud Users of Customer Data or Customer Content shall not affect the CSPs’ obligations under this Regulatory Framework. 3.8.3 The Commission may issue, from time to time, decisions on mandatory or voluntary certification schemes and standards for Cloud Computing, which may vary depending on the required level of information security, the type of CSP or Cloud Customer concerned, or by other criteria. 3.8.4 Without prejudice to any more specific requirement that may be required under Article 3.8.3‎ above, CSPs subject to a registration under Article 3.2‎‎ , above, must demonstrate to the Commission’s satisfaction, when applying for registration, that their Cloud Services will be of an acceptable quality and sufficiently secure by general industry standards, based on: 3.8.4.1 the applicant’s resources dedicated to Cloud Computing, Cloud Computing Regulatory Framework Page 13 of 15