Cloud Risk Management
What this domain tests
Cloud Risk Management tests the end-to-end process: identify, analyze, evaluate, treat and monitor. Expect cloud-specific risks such as supply-chain dependency, multi-tenancy, data residency and jurisdiction, vendor lock-in, concentration risk, visibility gaps and ambiguous shared responsibility. You should distinguish inherent from residual risk and know how third-party risk, contracts and KRIs fit.
Core rules
- Identify assets, threats, vulnerabilities and affected obligations before scoring likelihood and impact.
- Assess inherent risk first, then apply controls and record residual risk. A vendor certification is a control input, not proof that risk is eliminated.
- Treatment options are avoid, mitigate, transfer, accept. Contracts and insurance can transfer some financial impact, but accountability is not transferred.
- Monitor with key risk indicators, SLA reporting and continuous control monitoring. Risk assessment is not a once-a-year event.
- Analyze concentration and exit risk: how many critical services depend on one provider, region or subservice organization?
Worked example
A CRM SaaS migration creates two risks. First, provider outage: impact high, likelihood medium. Controls include SLA credits, disaster recovery testing and an exit plan; residual risk may be accepted. Second, data residency: data is stored in another country. Controls include region selection, contractual commitments, encryption and legal review; residual risk is reduced but not zero. The two risks need separate owners and indicators.
Traps
Treating a vendor certificate as risk elimination; missing subservice organizations; omitting concentration and exit analysis; performing a static annual assessment with no KRIs.