Let's take a few minutes to review the primary points of
legal, risk, and compliance domain.
First,
it's really important to pay attention to the exam content outline that
shows that there are five main areas. Articulate legal requirements and
unique risk within the cloud environment is the first of five areas
that you need to know for the exam. Understand privacy issues.
Understand audit process, methodologies, and required adaptations for a
cloud environment.
Understand implications of cloud to enterprise risk management. And
understand outsourcing and contract design in the cloud.
The key points to recall is make sure that whatever the law
is in the place where you are consuming cloud services needs
to be observed and followed.
Also, risk management is not just being risk adverse,
it's actually applying what the business focus is in the
security practice. And when you want assurance for maintaining
and consuming services in the cloud,
you have to follow through with cloud audits.
Sometimes it just means consuming the audit that's already been done
for you. From a legal and regulatory requirements perspective, always
know first what the global standards are,
what kind of international law may have impact on what it
is that you're trying to accomplish.
You'll recall during the course, the International Court of
Justice hears contentious proceedings and other types of
hearings for international law.
Regional standards is probably going to be the largest
difference maker when it comes to what you need to adhere
to in consuming cloud services,
but you should also know about municipal standards as well.
Where regulatory focuses on particular business practices, in
particular industry verticals,
law focuses on what is required of all citizens of a regime and visitors.
In essence,
you are visiting another location when you're consuming cloud services
outside of the region where you are. Cloud risk management starts with
understanding the separation between threats,
threat agents, countermeasures, safeguards,
controls, assets, impact,
understanding these things are really important, and being able to make sure
that you select the proper type of risk management framework for your
consumption of the cloud. As an example, ISO 31000 is a cloud‑ready risk
management framework. Quantitative and qualitative analysis, analysis, that
are empirical versus something that is subjective in a qualitative way, both
of these work well together.
Qualitative helps to ensure that you are putting the right resources and the
right focus and the right amount of threat in your environment.
Then you can follow that up with quantitative. Remember
the four aspects of risk treatment, the modification of risk,
the sharing of risk, the avoidance of risk, and risk retention.
All of these are driven by what the business wants to accomplish.
Keep in mind, the greatest assurance that you can have in consuming
cloud services that align with your business requirements is
through an attestation or certification.
Attestations follow the course of service organization control audits 1
and 2, and type 2 and type 2, and certifications are plentiful in the
cloud. Two noteworthy ones are ISO 27017 and 18 that are cloud designed
certifications for protecting privacy.
Cloud provider registries are also helpful in your
selection criteria for cloud consumers.
Remember EuroCloud, StarAudit, and also the STAR
registry from Cloud Security Alliance.
That ISO 27017 and 27018 are replicas of ISO 27001
and 27002, except for the cloud.
The acceptability of testing on a provider's platform should be
investigated in the rules of engagement before you do test.
Finally,
be sure to take the self‑assessment questions that accompany
the study guide at the end of this domain.
Think about why one answer is going to be superior than another, and
make sure to grab that study guide, as it is a good way of thinking
about terminology through a series of questions.
Also, make sure that you focus on the domain that is giving you the most
difficulty now that you have reached the conclusion, this being the six of six
domains. Wishing you the best in your exam endeavors!