If using a cloud provider, who should provide the security certification?
For the security certification, the general guideline is that it would need to be provided for the legal entity that hosts the node. Depending on your situation / set up of your node, if there is a need to consider something out of the norm, this can be checked with the EBP.