Cloud Governance, Risk, and Compliance
This domain tests whether you can turn regulatory and business obligations into enforceable cloud controls, then prove they work. Expect questions on governance models, risk assessment, control frameworks, audit evidence, and data residency.
Core rules
- Governance starts with policy: acceptable use, data classification, residency, and supplier risk. Encode policy as code (SCPs, Azure Policy, Org Policies) so it is testable.
- Map requirements to a control set: CSA CCM, ISO/IEC 27017/27018, SOC 2, PCI DSS, HIPAA, GDPR. Record inherited, shared, and customer-owned controls.
- Risk assessment must include concentration risk (single provider or region), subservice organizations, and exit strategy.
- Compliance is continuous: CSPM findings, evidence collection, and exception handling feed the risk register.
Worked example
A payments team must meet PCI DSS and GDPR on AWS. They map cardholder data flows, place the cardholder data environment in a separate account with a customer-managed KMS key, enable an organization CloudTrail trail and Config rules, and sign a data processing addendum. Reasoning: the provider's SOC 2 covers physical and hypervisor layers, but the team still owns IAM, encryption policy, logging, and segmentation. Evidence comes from configuration snapshots and key policies, not the provider's certificate alone.
Traps
- Treating a provider's certification as covering your application.
- Forgetting subservice organizations and carve-outs in SOC 2 reports.
- Assuming region selection solves data residency without checking backups, support access, and logs.