I85PREP
⌘ K
CSPCC study materials
CSPCC study resources

CSPCC: Compliance, Legal, and Audit Considerations for Cloud Services

CSPCC · Work through your exam, one topic at a time.

All guide sections

Compliance, Legal, and Audit Considerations for Cloud Services

What this domain tests

Compliance, Legal, and Audit Considerations for Cloud Services tests how contracts, audit evidence, jurisdiction, and retention obligations apply when data and operations sit with a provider. Expect questions on SOC 2, ISO/IEC 27001/27017/27018, FedRAMP, GDPR, DPAs, subprocessors, eDiscovery, and right-to-audit clauses.

Core rules and concepts

  • A provider's certification or attestation covers the provider's system and stated scope, not the customer's configuration. Read the scope, period, exceptions, and complementary customer controls.
  • SOC 2 is an attestation report against trust services criteria; ISO/IEC 27001 certifies a management system; ISO/IEC 27017 adds cloud-specific controls; ISO/IEC 27018 addresses public-cloud PII processors; FedRAMP authorizes cloud services for US federal use.
  • Contracts must allocate responsibility for data processing, breach notification, subprocessors, audit rights, return and deletion, service levels, and liability. A DPA is required for personal data processing under GDPR-style regimes.
  • Auditability depends on evidence: config snapshots, logs, access reviews, change tickets, and control test results. Cloud-native audit logs can support continuous control monitoring.
  • Jurisdiction follows legal reach and contract terms, not only data-center location. Subpoenas and government access can apply to the provider's legal entity.

Worked example

A healthcare customer wants to use a US cloud region and must satisfy HIPAA and a state breach-notification law. The provider offers a business associate agreement and SOC 2 Type II report. The customer must still sign the BAA, configure encryption and access logging, restrict ePHI to covered services, review subprocessors, and set retention. The provider report is evidence for inherited controls, not a substitute for the customer's risk analysis. The reasoning is scope mapping: legal obligation, provider assurance, and customer controls must align.

Traps that cost marks

  • Saying a provider is 'HIPAA compliant' without a BAA and scoped configuration.
  • Treating a SOC 2 report as a pass/fail certificate.
  • Ignoring subprocessors and cross-border transfer mechanisms.
  • Assuming data location alone determines jurisdiction.
  • Forgetting deletion, legal hold, and eDiscovery obligations in cloud storage.