Cloud Governance, Risk, Audit, & Compliance
Governance in a rented world
Cloud governance is the set of policies, decision rights, and oversight mechanisms that keep cloud use aligned with business objectives. Practical artifacts include an enterprise cloud policy, acceptable-use rules, data classification, a service approval workflow, and defined exception handling. The frameworks to know by name: the CSA Cloud Controls Matrix (CCM) as a control catalog mapped to ISO 27001, PCI DSS, NIST, and others; the CAIQ as the self-assessment questionnaire that populates it; the STAR registry as the public repository of assessments; ISO/IEC 27017 for cloud-specific controls and 27018 for PII in public cloud; SOC 2 for service organizations; and FedRAMP for US federal authorizations.
Risk
Cloud risk assessment is ordinary risk assessment plus new dependencies: provider concentration risk, supply chain and subprocessor risk, data residency and sovereignty, lock-in and exit, and the risk that a control is asserted but not evidenced.
Audit
You will seldom audit a provider's datacenter. You inherit assurance through third-party reports, chiefly SOC 2 Type II (a period of time, tests operating effectiveness) versus Type I (a point in time, design only). Contracts should grant a right to audit, notification of material changes, and access to attestations.
Traps
- SOC 2 is an attestation report, not a certification.
- ISO 27001 certifies the provider's management system, not the security of your data.
- The provider being compliant does not make you compliant; you still own your layer.
- A CCM control marked shared does not mean the provider performs it.
Rule of thumb
Prefer evidence over assertion: for every inherited control, ask which document proves it and who signed it.