Domain 2 - Governance and Enterprise Risk Management

Question 1

What 4 areas of governance and risk management are impacted by cloud computing?

Answer 1

1. Governance
2. Enterprise Risk Management
3. Information Risk Management
4. Information Security

Question 2

What is Governance?

Answer 2

Governance includes the policy, process, and internal controls that comprise how an organization is run. Everything from the structures and policies to the leadership and other mechanisms for management.

Question 3

What is Enterprise Risk Management?

Answer 3

Enterprise risk management includes managing overall risk for the organization, aligned to the organization’s governance and risk tolerance. Enterprise risk management includes all areas of risk, not merely those concerned with technology.

Question 4

What is Information risk management?

Answer 4

Information risk management covers managing the risk to information, including information technology. Organizations face all sorts of risks, from nancial to physical, and information is only one of multiple assets an organization needs to manage.

Question 5

What is information Security?

Answer 5

Information security is the tools and practices to manage risk to information. Information security isn’t the be-all and end-all of managing information risks; policies, contracts, insurance, and other mechanisms also play a role (including physical security for non-digital information). However, a—if not the—primary role of information security is to provide the processes and controls to protect electronic information and the systems we use to access it.

Question 6

Put the following in order of hierarchy.

ERM, IRM, InfoSec, Governance

Answer 6

1. Governance is at the top.
2. then Enterprise Risk Management
3. then Information risk management
4. Information security

Question 7

What is the primary thing to remember when governing cloud computing?

Answer 7

The primary issue to remember when governing cloud computing is that an organization can never outsource responsibility for governance, even when using external providers. This is always true, cloud or not, but is useful to keep in mind when navigating cloud computing’s concepts of shared responsibility models.

Question 8

If it’s not in the contract what is the concern?

Answer 8

If the area of concern isn’t in the contract, there are no mechanisms available to enforce, and there is a governance gap.

Remember: Contracts defne the relationship between providers and customers and are the primary tool for customers to extend governance to their suppliers.

Question 9

What are 3 tools of cloud governance?

Answer 9

1. contracts
2. Supplier (cloud provider) Assessments
3. Compliance Reporting

Question 10

What is a Supplier (Cloud Provider ) Assessment?

Answer 10

These assessments are performed by the potential cloud customer using available information and allowed processes/techniques. They combine contractual and manual research with third-party attestations (legal statements often used
to communicate the results of an assessment or audit) and technical research. They are very similar to any supplier assessment and can include aspects like nancial viability, history, feature o erings, third-party attestations, feedback from peers, and so on

Question 11

What is Compliance Reporting?

Answer 11

Compliance reporting includes all the documentation on a provider’s internal (i.e. self) and external compliance assessments. They are the reports from audits
of controls, which an organization can perform themselves, a customer can perform on a provider (although this usually isn’t an option in cloud), or have performed by a trusted third party. Third-party audits and assessments are preferred since they provide independent validation (assuming you trust the third party)

Question 12

What is critical to consider in reviewing assessments and audits?

Answer 12

Scope.

It’s critical to understand the scope, not just the standard used. Standards like the SSAE 16 have a de ned scope, which includes both what is assessed (e.g. which of the provider’s services) as well as which controls are assessed. A provider can thus “pass” an audit that doesn’t include any security controls, which isn’t overly useful for security and risk managers. Also consider the transitive trust required to treat a third-party assessment as equivalent to the activities that you might undertake when doing your own assessment. Not all audit rms (or auditors) are created equal and the experience, history, and quali cations of the rm should be included in your governance decisions

Question 13

What is the STAR Registry?

Answer 13

The Cloud Security Alliance STAR Registry is an assurance program and documentation registry for cloud provider assessments based on the CSA Cloud Controls Matrix and Consensus Assessments Initiative Questionnaire. Some providers also disclose documentation for additional certi cations and assessments (including self-assessments).

Question 14

What is Risk Management in the cloud based upon?

Answer 14

Risk management in cloud is based on the shared responsibilities model (which we most often discuss in reference to security). The cloud provider accepts some responsibility for certain risks, and the cloud customer is responsible for anything beyond that. This is especially evident as you evaluate di erences between the service models, where the provider manages more risks in SaaS and the consumer more in IaaS

Question 15

Who is ultimately responsible for ownership of the risks?

Answer 15

the cloud user is ultimately responsible for ownership of the risks; they only pass on some of the risk management to the cloud provider. This holds true even Software
as a Service (SaaS)
Platform
as a Service (PaaS)
with a self-hosted private cloud; in those situations an organizational unit is passing on some of their risk management to the internal cloud provider instead of an external party, and internal SLAs and procedures replace external contracts.

Question 16

How do you know where the division of responsibilities and untreated risk lie?

Answer 16

ERM relies on good contracts and documentation to know where the division of responsibilities and potential for untreated risk lie.

Question 17

What is risk tolerance?

Answer 17

Risk tolerance is the amount of risk that the leadership and stakeholders of an organization are willing to accept

Question 18

Which cloud service model relies most on a contract to manage risk?

Answer 18

SaaS

Question 19

What components of IaaS are most often over looked in terms of Risk?

Answer 19

The underlying orchestration and management layers.

Question 20

Are contracts more flexible in public or private clouds?

Answer 20

The are more flexible in private clouds. Public cloud providers have to account for multitenancy thus restricting how flexible they can be.

Question 21

Self-hosted private governance typically focused on what?

Answer 21

Internal SLA agreements.

Question 22

What are some advantages and disadvantages for cloud deployments in terms of risk.

Answer 22

There is less physical control over assets and their controls and processes. You don’t physically control the infrastructure or the provider’s internal processes.
• There is a greater reliance on contracts, audits, and assessments, as you lack day-to-day visibility or management.
• This creates an increased requirement for proactive management of relationship and adherence to contracts, which extends beyond the initial contract signing and audits. Cloud providers also constantly evolve their products and services to remain competitive and these ongoing innovations might exceed, strain, or not be covered by existing agreements and assessments.
• Cloud customers have a reduced need (and associated reduction in costs) to manage risks that the cloud provider accepts under the shared responsibility model. You haven’t outsourced accountability for managing the risk, but you can certainly outsource the management of some risks.

Question 23

Describe the supplier assessment process

Answer 23

The supplier assessment sets the groundwork for the cloud risk management program:
• Request or acquire documentation.
• Review their security program and documentation.
• Review any legal, regulatory, contractual, and jurisdictional requirements for both the provider
and yourself. (See the Domain 3: Legal for more.)
• Evaluate the contracted service in the context of your information assets.
• Separately evaluate the overall provider, such as nances/stability, reputation, and outsourcers