CoreQ Academy4.2 Compare and contrast aspects of compliance and regulation.
Cloud makes it easy to put data anywhere, so compliance means knowing where data is, who owns it, how it is classified and how long it is kept.
Data
- Data sovereignty
- Data is subject to the laws of the country where it is stored.
- Data ownership
- Who is accountable for the data and decides how it is used; usually the customer, not the provider.
- Data locality
- Where data physically resides; choose regions to satisfy requirements.
- Data classification
- Labelling data by sensitivity to drive controls.
- Data retention
- How long data must or may be kept.
- Litigation hold
- Suspending deletion of data relevant to legal proceedings.
- Contractual
- Retention or handling terms required by contracts with customers or partners.
- Regulatory
- Retention or handling required by law or regulators.
Industry standards
- Systems and Organization Controls 2 (SOC2)
- An independent audit report on a service organisation's controls for security, availability, processing integrity, confidentiality and privacy. Type II covers effectiveness over a period.
- Payment Card Industry Data Security Standards (PCI DSS)
- Requirements for anyone storing, processing or transmitting payment card data.
- International Organization for Standardization (ISO) 27001
- Certifiable standard for an information security management system (ISMS).
- Cloud Security Alliance
- Industry body publishing the Cloud Controls Matrix (CCM), CAIQ questionnaire and STAR registry for cloud provider assurance.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.2 of the publicly available CompTIA Cloud+ CV0-004 exam objectives (Exam objectives V4, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.