3. Risk, Audit and Compliance

In the 2022 Cloud Security Alliance “Pandemic Eleven,” top threats were:
● Insufficient Identity, Credentials, Access, and Key Management
● Insecure Interfaces and APIs
● Misconfiguration and Inadequate Change Control
● Lack of Cloud Security Architecture and Strategy
● Insecure Software Development
● Unsecured Third-Party Resources
● System Vulnerabilities
● Accidental Cloud Data Disclosure
● Misconfiguration and Exploitation of Serverless and Container Workloads
● Organized Crime/Hackers/Advanc

Risk Assessment: Identify and analyze relevant risks to understand their potential impact on the organization. This involves evaluating each risk to determine the likelihood of occurrence and the severity of its consequences.

Risk Treatment: After assessing risks, develop and approve an action plan to mitigate, transfer, avoid, or accept each risk. Implement these action plans and identify any residual risks that remain.

This process ensures cloud services meet your needs by:
- Starting with business requests,
- Checking the CSP’s docs and external sources,
- Matching to compliance rules and data types,
- Defining needed controls (and backup ones if required),
- Finally, getting official approval before use.

  1. Business Requests Whether or not the business unit has a specific cloud service in mind, it is important to understand the business need and the data involved

  2. Review CSP Documentation:

    1. Security and privacy documentation: Review the CSP’s published security policies, privacy policies, and data handling practices to ensure they align with your organization's standards.

    2. Service level agreements (SLA) and contracts: SLAs outline the performance and uptime commitments of the CSP, while contracts detail the terms of service, including responsibilities and liabilities.

    3. Terms of service (ToS): Understanding the ToS is important to avoid legal or operational surprises post-adoption. These may be the only legal contracts between you and the provider.

    4. CAIQ and certifications: The CSA Consensus Assessments Initiative Questionnaire (CAIQ), based on the Cloud Controls Matrix (CCM), provides a comprehensive set of questions that CSPs answer to disclose their security controls. CSP certifications (e.g., ISO/IEC 27001, SOC 2) offer third-party validation of their security practices.

  3. Review External Sources Research: Investigate external reviews, reported vulnerabilities, and any past security and operational incidents involving the CSP to gauge their security posture and response capabilities.