A processing device comprises a processor coupled to a memory and implements an obligation management system for information technology infrastructure, with the obligation management system being configured to process a plurality of obligations on behalf of a relying party to verify implementation of corresponding controls in information technology infrastructure of a claimant. A given one of the obligations has an associated obligation fulfiller that is inserted or otherwise deployed as a component within the information technology infrastructure of the claimant and is configured to provide evidence of the implementation of one or more of the controls responsive to an obligation assertion so as to establish an associated trust aspect of the claimant. The information technology infrastructure may comprise distributed virtual infrastructure of a cloud service provider. The claimant may comprise the cloud service provider and the relying party may comprise a tenant of the cloud service provider.