Cloud Application Security Standards, Frameworks, and Governance
This domain asks how you prove and continuously maintain control, not merely which certificate you hold. Items test framework mapping, the limits of third-party attestations, and how written policy becomes enforceable guardrails in a cloud estate.
Core rules
- Know the layers. Management-system standards: ISO/IEC 27001, with 27017 for cloud-specific controls and 27018 for PII in public cloud. Control catalogs: NIST SP 800-53 and the CSA Cloud Controls Matrix. Outcome frameworks: NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover). Assurance reports: SOC 2 Type I covers design at a point in time; Type II covers operating effectiveness across a period. Regulation: PCI DSS v4.0, GDPR, HIPAA, FedRAMP.
- Compliance is inherited, never transferred. Provider attestations cover the provider's layer; your configuration and evidence are still required.
- Map once, comply many. Build a control matrix with framework references, control owner, evidence source, and test frequency so one control satisfies several obligations.
- Turn policy into guardrails: preventive (organization policies, SCPs, admission control), detective (CSPM, configuration rules), corrective (automated remediation).
- Manage exceptions explicitly: documented risk acceptance, named approver, expiry date, and compensating control.
Worked example
A SaaS vendor must demonstrate data residency and access control to a regulated customer. It holds SOC 2 Type II for the platform and ISO/IEC 27001 for its management system. Reasoning: SOC 2 covers the trust services criteria over the audit period but says nothing about where data is stored; ISO 27017 attestation supports cloud-specific controls but does not prove the vendor restricted storage to a region. The correct response is a control mapping showing region restriction enforced by organization policy, verified by continuous configuration scanning, with the auditor's report cited as inherited evidence for the provider layer only. Claiming the certificate "makes us compliant" is a fail.
Traps
Treating a provider certificate as coverage for your workloads; citing a Type I report as evidence of operating effectiveness; confusing a framework (what to do) with certification (how you prove it); overlooking fourth-party/supplier risk; and quoting breach-notification or retention rules without naming the jurisdiction that imposes them.