Cloud service governance, risk and compliance
What this domain tests
Cloud service governance, risk and compliance tests whether you can set direction, monitor performance and assure obligations when controls are shared with providers. Expect questions on governance bodies, risk appetite, compliance obligations, data residency and privacy, supplier and subprocessor risk, audit rights, policy enforcement and exit.
Core rules
- Governance is not day-to-day operations. It sets direction, monitors conformance and assures that risk and compliance are managed.
- Map obligations to services and data. Identify legal, regulatory, contractual and internal requirements, then assign controls and evidence.
- Apply shared responsibility precisely. The provider may secure the infrastructure, but the consumer remains accountable for its data, identities, configurations and use.
- Assess provider and subprocessor risk: jurisdiction, certification, breach notification, audit rights, continuity and exit.
- Record accepted residual risk with an owner. Compliance is evidence-based, not a one-time certificate.
Worked example
A bank plans to store customer records in a public cloud region. The team classifies the data, maps residency and privacy obligations, reviews the provider's audit reports and subprocessors, defines encryption and access controls, and tests breach notification. Residual risk is accepted by the accountable owner. Reasoning: the provider's certificate supports assurance but does not prove the bank's configuration is compliant. The bank must show its own controls and evidence.
Traps
Equating 'provider is certified' with 'we are compliant'; ignoring subprocessors and data flows; treating risk assessment as a one-off; no audit or exit rights; and allowing shadow cloud use outside governance.