Domain 2 - Governance & Risk Management

Question 1

How does cloud computing impact governance & risk management?

Answer 1

In four areas:

a) Governance - because it introduces a third party.
b) Enterprise Risk Management
c) Information Risk Management
d) Information Security

Question 2

What is Governance?

Answer 2

• Policies, processes, and internal controls that comprise how an organization is run.
• Mechanisms for management including structures and leadership.

Question 3

What is Enterprise risk management?

Answer 3

• Managing overall risk to the organization.
• It is more than those concerned with technology
• Other risks - e.g. regulatory, supply chain, financial, etc.

Question 4

What is Information Risk Management?

Answer 4

• Manages risk to information including information technology

Question 5

What is information security?

Answer 5

• Tools and practices to manage risk to information.
• Information risk can be managed by other means besides information security - e.g. contracts, insurance, and physical security etc.

Question 6

What is the relationship between governance, ERM, IRM and IS?

Answer 6

IS is a tool of IRM
IRM is a tool of ERM
ERM is a tool of Governance.

Question 7

What are the tools of cloud governance?

Answer 7

1) Contracts - between a CSP and CSC.
2) Supplier assessment - may include financial viability, history, features, 3PAttestations, peer feedback
3) Compliance reporting - audit of controls by 3Ps.

Question 8

How does service models affect governance?

Answer 8

• SaaS - most critical example of the need for a negotiated contract
• PaaS - likelihood of fully negotiated contract is lower
• IaaS - existing governance structures may be transferrable.

Question 9

How does deployment models (public, private, hybrid) affect governance?

Answer 9

• Public clouds - contracts may be inflexible; CSP has incentive to keep everything current; governance has to accommodate this fact.
• Private cloud - more flexible contract; but CSP may offer just what’s in the contract; governance focus on internal SLAs and charge backs for accounting.
• Hybrid - governance issues multiple domains
• Community - governance must consider relationships with other members of the community in addition to provider.

Question 10

What’s a process to manage cloud risk?

Answer 10

• Review CSP’s documentation
• Review CSP’s security program
• Review legal, regulatory, industry, contract
• Evaluate service based on context of information assets
• Evaluate provider (finances, reputation, insurers etc.)
• Periodically review audits and assessments