ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationHard
An organization is migrating its data center to a cloud provider. The IS auditor is evaluating the contract with the cloud service provider (CSP). Which of the following clauses is MOST critical for the auditor to verify to ensure data ownership and transferability upon contract termination?
- AService Level Agreement (SLA) terms for uptime and performance.
- BIndemnification clauses for breach of contract.
- CData portability and exit strategy clauses.
- DCompliance with relevant industry standards (e.g., ISO 27001).
Show answer & explanationAnswer & explanation
Correct answer: C. Data portability and exit strategy clauses.
Data portability and exit strategy clauses are paramount for ensuring the organization retains ownership of its data and can seamlessly transfer it out of the CSP's environment upon contract termination or if the organization decides to switch providers. Without clear provisions, the organization could face vendor lock-in, data loss, or exorbitant costs to retrieve its data, posing a significant business risk.
Why the other options are wrong
- A. SLA terms are important for operational performance during the contract, but don't address post-termination data handling.
- B. Indemnification clauses deal with financial protections in case of contract breach, not the practical aspects of data transfer post-termination.
- D. Compliance with standards is crucial for security and governance during service, but doesn't specifically detail how data will be handled upon contract exit.
Cloud Exit Strategy
A documented plan outlining the procedures, responsibilities, and technical requirements for migrating data and applications out of a cloud provider's environment.
- Ensures data ownership and access upon termination.
- Prevents vendor lock-in.
- Addresses data format, transfer methods, and timelines.
- Should be defined in the contract with the CSP.
Memory trick: Cloud Contract: Exit Strategy is Key.