Cloud Compliance
What this domain tests
Cloud Compliance tests how obligations become auditable controls. Topics include scoping, control inheritance, evidence, continuous compliance and framework mapping. Relevant references include ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, the CSA Cloud Controls Matrix, NIST publications, PCI DSS, HIPAA and GDPR. You need to know that the provider's certification does not automatically cover the customer's use of the service.
Core rules
- Start with obligations: laws, regulations, contracts and internal policy. Then map them to a control framework.
- Scope determines what is audited: systems, data, locations, providers and processes. Segmentation can reduce scope, but only if it is proven.
- Control inheritance works at the requirement level. A provider control may satisfy part of a requirement; the customer still needs complementary controls.
- Evidence must show design and operation, not just intent. Keep a control-to-obligation mapping and retain provider reports and customer configuration evidence.
- Compliance is continuous. Annual certification does not prove that controls operated last week.
Worked example
A merchant stores card data on IaaS virtual machines. The provider is PCI DSS certified for its infrastructure. Reasoning: the customer still owns guest OS hardening, access control, logging, vulnerability management, segmentation of the cardholder data environment and evidence of operation. The provider certificate does not cover the customer's configurations or card-data flows.
Traps
Assuming provider certification covers customer scope; confusing certification with attestation; treating compliance as a one-time project; over-scoping or under-scoping; failing to map evidence to each obligation.